# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Sep 16 2019 10:43:25 # Log Creation Date: 01.10.2019 07:39:09.600 Process: id = "1" image_name = "ls_appdatasample.exe.exe" filename = "c:\\users\\fd1hvy\\desktop\\ls_appdatasample.exe.exe" page_root = "0x3156000" os_pid = "0xd10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x7a4 [0036.598] GetProcessHeap () returned 0x560000 [0036.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572388 [0036.598] GetProcessHeap () returned 0x560000 [0036.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56fa70 [0036.639] GetProcessHeap () returned 0x560000 [0036.639] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572388 | out: hHeap=0x560000) returned 1 [0036.639] GetProcessHeap () returned 0x560000 [0036.639] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x560000) returned 1 [0036.639] GetProcessHeap () returned 0x560000 [0036.640] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x20) returned 0x56ae38 [0036.640] GetProcessHeap () returned 0x560000 [0036.640] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x57f860 [0036.644] GetProcessHeap () returned 0x560000 [0036.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9b4) returned 0x57ddc8 [0036.644] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57f860, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ls_appdatasample.exe.exe")) returned 0x30 [0036.644] GetProcessHeap () returned 0x560000 [0036.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572388 [0036.644] GetProcessHeap () returned 0x560000 [0036.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56fa70 [0036.652] GetProcessHeap () returned 0x560000 [0036.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572388 | out: hHeap=0x560000) returned 1 [0036.652] GetProcessHeap () returned 0x560000 [0036.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x560000) returned 1 [0036.652] GetProcessHeap () returned 0x560000 [0036.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572388 [0036.652] GetProcessHeap () returned 0x560000 [0036.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56fa70 [0036.661] GetProcessHeap () returned 0x560000 [0036.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572388 | out: hHeap=0x560000) returned 1 [0036.661] GetProcessHeap () returned 0x560000 [0036.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x560000) returned 1 [0036.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0036.661] GetProcessHeap () returned 0x560000 [0036.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57e940 [0036.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017b8, cbMultiByte=-1, lpWideCharStr=0x57e940, cchWideChar=8 | out: lpWideCharStr=".badday") returned 8 [0036.661] GetProcessHeap () returned 0x560000 [0036.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572388 [0036.662] GetProcessHeap () returned 0x560000 [0036.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56fa70 [0036.707] GetProcessHeap () returned 0x560000 [0036.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572388 | out: hHeap=0x560000) returned 1 [0036.707] GetProcessHeap () returned 0x560000 [0036.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x560000) returned 1 [0036.707] lstrlenA (lpString="Windows,Microsoft,Microsoft Help,Windows App Certification Kit,Windows Defender,ESET,COMODO,Windows NT,Windows Kits,Windows Mail,Windows Media Player,Windows Multimedia Platform,Windows Phone Kits,Windows Phone Silverlight Kits,Windows Photo Viewer,Windows Portable Devices,Windows Sidebar,WindowsPowerShell,NVIDIA Corporation,Microsoft.NET,Internet Explorer,Kaspersky Lab,McAfee,Avira,spytech software,sysconfig,Avast,Dr.Web,Symantec,Symantec_Client_Security,system volume information,AVG,Microsoft Shared,Common Files,Outlook Express,Movie Maker,Chrome,Mozilla Firefox,Opera,YandexBrowser,ntldr,Wsus,ProgramData") returned 613 [0036.707] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2060000 [0036.707] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x0, Size=0xac) returned 0x20605a8 [0036.710] GetProcessHeap () returned 0x560000 [0036.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572388 [0036.710] GetProcessHeap () returned 0x560000 [0036.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56fa70 [0036.742] GetProcessHeap () returned 0x560000 [0036.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572388 | out: hHeap=0x560000) returned 1 [0036.742] GetProcessHeap () returned 0x560000 [0036.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x560000) returned 1 [0036.742] lstrlenA (lpString=".badday") returned 7 [0036.742] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2050000 [0036.743] RtlAllocateHeap (HeapHandle=0x2050000, Flags=0x0, Size=0x4) returned 0x20505a8 [0036.743] GetProcessHeap () returned 0x560000 [0036.743] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x580868 [0036.743] GetEnvironmentVariableW (in: lpName="LOCALAPPDATA", lpBuffer=0x580868, nSize=0x800 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1d [0036.743] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Local" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="" [0036.749] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0036.749] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\", lpString2="LS_APPDATASAMPLE.EXE.exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe" [0036.749] lstrcmpiW (lpString1="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe") returned 1 [0036.751] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ls_appdatasample.exe.exe")) returned 0xffffffff [0036.751] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ls_appdatasample.exe.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ls_appdatasample.exe.exe"), bFailIfExists=0) returned 1 [0036.923] _alloca_probe () returned 0x40961a [0036.923] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef60 | out: phkResult=0x19ef60*=0x1d8) returned 0x0 [0036.923] RegQueryValueExW (in: hKey=0x1d8, lpValueName="BrowserUpdateCheck", lpReserved=0x0, lpType=0x0, lpData=0x19ef68, lpcbData=0x19ef64*=0x800 | out: lpType=0x0, lpData=0x19ef68*=0x0, lpcbData=0x19ef64*=0x800) returned 0x2 [0036.923] lstrcmpiW (lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe") returned -1 [0036.923] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x1, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x19ef60, lpdwDisposition=0x0 | out: phkResult=0x19ef60*=0x1fc, lpdwDisposition=0x0) returned 0x0 [0036.923] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe") returned 54 [0036.923] RegSetValueExW (in: hKey=0x1fc, lpValueName="BrowserUpdateCheck", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe", cbData=0x6c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\LS_APPDATASAMPLE.EXE.exe") returned 0x0 [0036.924] RegCloseKey (hKey=0x1fc) returned 0x0 [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x581870 [0036.924] GetEnvironmentVariableW (in: lpName="public", lpBuffer=0x581870, nSize=0x800 | out: lpBuffer="C:\\Users\\Public") returned 0xf [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x98) returned 0x57d920 [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40) returned 0x572e30 [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x42) returned 0x5732b0 [0036.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x5732b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x82) returned 0x571de8 [0036.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x5732b0, cbMultiByte=-1, lpWideCharStr=0x571de8, cchWideChar=65 | out: lpWideCharStr="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 65 [0036.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e) returned 0x582f70 [0036.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017e8, cbMultiByte=-1, lpWideCharStr=0x582f70, cchWideChar=23 | out: lpWideCharStr="how_to_back_files.html") returned 23 [0036.924] lstrcpyW (in: lpString1=0x57d920, lpString2="how_to_back_files.html" | out: lpString1="how_to_back_files.html") returned="how_to_back_files.html" [0036.924] GetProcessHeap () returned 0x560000 [0036.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x583080 [0036.924] lstrcpyW (in: lpString1=0x583080, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0036.924] PathAddBackslashW (in: pszPath="C:\\Users\\Public" | out: pszPath="C:\\Users\\Public\\") returned="" [0036.924] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3" | out: lpString1="C:\\Users\\Public\\9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned="C:\\Users\\Public\\9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3" [0036.924] CreateFileW (lpFileName="C:\\Users\\Public\\9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3" (normalized: "c:\\users\\public\\9707f881606f1a60e0a22d9ba3f754edbd347c63b206910712c150a325d7d8e3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0036.926] GetLastError () returned 0x0 [0036.926] GetProcessHeap () returned 0x560000 [0036.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x400) returned 0x584088 [0036.926] lstrlenA (lpString="rsa_genkey") returned 10 [0036.926] CryptAcquireContextW (in: phProv=0x19f848, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19f848*=0x572708) returned 1 [0037.246] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x19f860 | out: pbBuffer=0x19f860) returned 1 [0037.246] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x5788b0 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572fe0 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572ec0 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572bf0 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572d58 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x56f650 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572d58 | out: hHeap=0x560000) returned 1 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x56f300 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584818 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x578710 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5851a8 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.246] GetProcessHeap () returned 0x560000 [0037.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585088 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x5730b8 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x572708 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57eb80 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x572a40 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5730b8 | out: hHeap=0x560000) returned 1 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584d28 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec10 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x585b40 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5849c8 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585b40 | out: hHeap=0x560000) returned 1 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.247] GetProcessHeap () returned 0x560000 [0037.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.248] GetProcessHeap () returned 0x560000 [0037.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0037.249] GetProcessHeap () returned 0x560000 [0037.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d28 | out: hHeap=0x560000) returned 1 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57eb80 | out: hHeap=0x560000) returned 1 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585910 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585820 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585c80 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585aa0 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585960 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585be0 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5857d0 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5856e0 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a50 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5858c0 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d20 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585730 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585c30 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5859b0 [0037.250] GetProcessHeap () returned 0x560000 [0037.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585af0 [0037.250] GetProcessHeap () returned 0x560000 [0037.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a00 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585910 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585820 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c80 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585aa0 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585960 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585be0 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5857d0 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5856e0 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a50 | out: hHeap=0x560000) returned 1 [0037.251] GetProcessHeap () returned 0x560000 [0037.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5858c0 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d20 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585730 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c30 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5859b0 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585af0 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a00 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f300 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584818 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572ec0 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572bf0 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f650 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a8 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x5730b8 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572d10 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x573220 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5858c0 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x573220 | out: hHeap=0x560000) returned 1 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585640 [0037.252] GetProcessHeap () returned 0x560000 [0037.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584548 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x5786e0 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846f8 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c08 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572d58 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x572708 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57eb80 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585870 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572d58 | out: hHeap=0x560000) returned 1 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b78 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585870 | out: hHeap=0x560000) returned 1 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec10 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x585780 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585358 [0037.253] GetProcessHeap () returned 0x560000 [0037.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585780 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.254] GetProcessHeap () returned 0x560000 [0037.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.255] GetProcessHeap () returned 0x560000 [0037.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c08 | out: hHeap=0x560000) returned 1 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57eb80 | out: hHeap=0x560000) returned 1 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a00 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585820 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585960 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585870 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585910 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d70 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585c30 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5859b0 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585b40 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a50 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585cd0 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585c80 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585af0 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5857d0 [0037.256] GetProcessHeap () returned 0x560000 [0037.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d20 [0037.256] GetProcessHeap () returned 0x560000 [0037.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585aa0 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a00 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585820 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585960 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585870 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585910 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d70 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c30 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5859b0 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585b40 | out: hHeap=0x560000) returned 1 [0037.257] GetProcessHeap () returned 0x560000 [0037.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a50 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585cd0 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c80 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585af0 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5857d0 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d20 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585aa0 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585640 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584548 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572bf0 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5848a8 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec28 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5851a8 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5856e0 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572bf0 | out: hHeap=0x560000) returned 1 [0037.258] GetProcessHeap () returned 0x560000 [0037.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5844b8 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5856e0 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec10 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x585870 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5845d8 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585870 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.259] GetProcessHeap () returned 0x560000 [0037.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.259] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.260] GetProcessHeap () returned 0x560000 [0037.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.260] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a8 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844b8 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848a8 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5845d8 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec28 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5730b8 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572d10 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5858c0 | out: hHeap=0x560000) returned 1 [0037.261] GetProcessHeap () returned 0x560000 [0037.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846f8 | out: hHeap=0x560000) returned 1 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x573190 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x573220 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572ec0 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585870 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572ec0 | out: hHeap=0x560000) returned 1 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585640 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ae8 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x578830 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584db8 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b78 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x5730b8 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x572708 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57eb98 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d70 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5730b8 | out: hHeap=0x560000) returned 1 [0037.262] GetProcessHeap () returned 0x560000 [0037.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c98 [0037.262] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d70 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec28 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x5856e0 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec28 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ed8 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5856e0 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.263] GetProcessHeap () returned 0x560000 [0037.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.264] GetProcessHeap () returned 0x560000 [0037.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.264] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ed8 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57eb98 | out: hHeap=0x560000) returned 1 [0037.265] GetProcessHeap () returned 0x560000 [0037.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585730 [0037.265] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5859b0 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d20 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585c80 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585690 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5855f0 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585b90 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585960 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a00 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d70 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585be0 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585780 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5856e0 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5857d0 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585820 [0037.266] GetProcessHeap () returned 0x560000 [0037.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5858c0 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585730 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5859b0 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d20 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c80 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585690 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5855f0 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585b90 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585960 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a00 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d70 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585be0 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585780 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5856e0 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5857d0 | out: hHeap=0x560000) returned 1 [0037.267] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585820 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5858c0 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585640 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ae8 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x573190 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x573220 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585870 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db8 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x5730b8 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572c80 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x573190 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585aa0 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x573190 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585cd0 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584b78 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x578830 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5845d8 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.268] GetProcessHeap () returned 0x560000 [0037.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584548 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572bf0 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x572708 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57eb98 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d70 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572bf0 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584938 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d70 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec10 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x5855f0 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c08 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5855f0 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.269] GetProcessHeap () returned 0x560000 [0037.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.269] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.270] GetProcessHeap () returned 0x560000 [0037.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5786e0 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584548 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584938 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.271] GetProcessHeap () returned 0x560000 [0037.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c08 | out: hHeap=0x560000) returned 1 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57eb98 | out: hHeap=0x560000) returned 1 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a00 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d20 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585d70 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585910 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585b40 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585640 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585a50 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585730 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x5859b0 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585960 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585af0 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585b90 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585690 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585780 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585be0 [0037.272] GetProcessHeap () returned 0x560000 [0037.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585c30 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a00 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d20 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d70 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585910 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585b40 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585640 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a50 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585730 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5859b0 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585960 | out: hHeap=0x560000) returned 1 [0037.273] GetProcessHeap () returned 0x560000 [0037.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585af0 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585b90 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585690 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585780 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585be0 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c30 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585cd0 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5730b8 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572c80 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585aa0 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5845d8 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572c80 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572bf0 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x40) returned 0x572d10 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585730 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572d10 | out: hHeap=0x560000) returned 1 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x44) returned 0x585780 [0037.274] GetProcessHeap () returned 0x560000 [0037.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585088 [0037.275] GetProcessHeap () returned 0x560000 [0037.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x5786e0 [0037.275] GetProcessHeap () returned 0x560000 [0037.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c08 [0037.275] GetProcessHeap () returned 0x560000 [0037.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.275] GetProcessHeap () returned 0x560000 [0037.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5844b8 [0037.342] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5857d0 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d20 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a00 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585cd0 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585820 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585870 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585c30 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585d70 | out: hHeap=0x560000) returned 1 [0037.343] GetProcessHeap () returned 0x560000 [0037.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5856e0 | out: hHeap=0x560000) returned 1 [0037.413] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.413] WriteFile (in: hFile=0x1fc, lpBuffer=0x57ddc8*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x19faf4, lpOverlapped=0x0 | out: lpBuffer=0x57ddc8*, lpNumberOfBytesWritten=0x19faf4*=0x102, lpOverlapped=0x0) returned 1 [0037.418] GetProcessHeap () returned 0x560000 [0037.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40) returned 0x5730b8 [0037.418] GetProcessHeap () returned 0x560000 [0037.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40) returned 0x572d58 [0037.418] GetProcessHeap () returned 0x560000 [0037.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc0) returned 0x572448 [0037.418] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.418] CryptAcquireContextW (in: phProv=0x19f038, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19f038*=0x570aa8) returned 1 [0037.419] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x19f050 | out: pbBuffer=0x19f050) returned 1 [0037.419] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.419] lstrlenA (lpString="B569FB5F44C698A949656E96A9E75FA6F60ADBA55DEFEAC14F5DE863D9140C903F13B57D5A5EFB2A4711E69A238247B9104F777D16DC95CC9323754310CC35533429075FBA3451258EC46687280C78685121AA764DAB078989D18134639A58776E46A72DFD3125AD879FE10A40A78AA7716B6D32BC3EF20201036E4767596FE48E90E87ABEF9C751B66317A024E21D4D844A023C5033568EA484B71F03EF2BB00FAC9C59CE68FDA9461BCE90A8B84081E1897F959F3B6F4357C2111A95DA3C70314D354247F8770743036755FBCC7AB3BD48978F3989B12609AD9B89D47AA6C75CD17C06041C0B251B8B9049EE459AE3352E7985A914E9F4055A920A9548C335") returned 512 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x100) returned 0x570898 [0037.419] lstrlenA (lpString="010001") returned 6 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x5786e0 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x100) returned 0x570678 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x208) returned 0x5875e0 [0037.419] GetProcessHeap () returned 0x560000 [0037.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x578710 [0037.419] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x204) returned 0x5877f0 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x204) returned 0x587a00 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x100) returned 0x587c10 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20c) returned 0x587d18 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57eb98 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587f30 [0037.420] GetProcessHeap () returned 0x560000 [0037.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587c10 | out: hHeap=0x560000) returned 1 [0037.420] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x204) returned 0x588040 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587f30 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587f30 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x204) returned 0x588250 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587f30 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.421] GetProcessHeap () returned 0x560000 [0037.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.422] GetProcessHeap () returned 0x560000 [0037.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.422] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.423] GetProcessHeap () returned 0x560000 [0037.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.423] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.424] GetProcessHeap () returned 0x560000 [0037.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.424] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.425] GetProcessHeap () returned 0x560000 [0037.425] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.425] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.426] GetProcessHeap () returned 0x560000 [0037.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.427] GetProcessHeap () returned 0x560000 [0037.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.427] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.428] GetProcessHeap () returned 0x560000 [0037.428] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.429] GetProcessHeap () returned 0x560000 [0037.429] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.429] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.430] GetProcessHeap () returned 0x560000 [0037.430] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.430] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.431] GetProcessHeap () returned 0x560000 [0037.431] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x5787a0 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5787a0 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.432] GetProcessHeap () returned 0x560000 [0037.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.433] GetProcessHeap () returned 0x560000 [0037.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.433] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578710 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578770 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x578830 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578830 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587a00 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x588040 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587d18 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x588250 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57eb98 | out: hHeap=0x560000) returned 1 [0037.434] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5875e0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5877f0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572448 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5730b8 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572d58 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572f08 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572c80 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x573220 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572bf0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572fe0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57e788 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5788b0 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.435] GetProcessHeap () returned 0x560000 [0037.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584088 | out: hHeap=0x560000) returned 1 [0037.435] SetFilePointer (in: hFile=0x1fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x102 [0037.436] WriteFile (in: hFile=0x1fc, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x19ff64, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x19ff64*=0x300, lpOverlapped=0x0) returned 1 [0037.438] CloseHandle (hObject=0x1fc) returned 1 [0037.439] GetProcessHeap () returned 0x560000 [0037.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x860) returned 0x5875e0 [0037.439] GetProcessHeap () returned 0x560000 [0037.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa80) returned 0x587e48 [0037.439] GetProcessHeap () returned 0x560000 [0037.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x70) returned 0x572388 [0037.439] GetLogicalDrives () returned 0x4 [0037.439] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0037.439] GetProcessHeap () returned 0x560000 [0037.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3) returned 0x578830 [0037.440] lstrcpyA (in: lpString1=0x578830, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0037.440] GetProcessHeap () returned 0x560000 [0037.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57eb80 [0037.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4096d7, lpParameter=0x57eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0037.440] WaitForMultipleObjects (nCount=0x1, lpHandles=0x19f6f4*=0x1fc, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xb6c Thread: id = 3 os_tid = 0xa78 [0037.443] _alloca_probe () returned 0x4096e1 [0037.443] CryptAcquireContextW (in: phProv=0x24ad700, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24ad700*=0x572708) returned 1 [0037.444] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24ad718 | out: pbBuffer=0x24ad718) returned 1 [0037.444] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0037.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x578830, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0037.444] GetProcessHeap () returned 0x560000 [0037.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x578770 [0037.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x578830, cbMultiByte=-1, lpWideCharStr=0x578770, cchWideChar=4 | out: lpWideCharStr="C:\\") returned 4 [0037.444] GetProcessHeap () returned 0x560000 [0037.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5788b0 [0037.444] lstrlenW (lpString="C:\\") returned 3 [0037.444] GetProcessHeap () returned 0x560000 [0037.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5786e0 [0037.444] lstrcpyW (in: lpString1=0x5786e0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0037.444] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0037.444] GetProcessHeap () returned 0x560000 [0037.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x560000) returned 1 [0037.444] GetProcessHeap () returned 0x560000 [0037.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5788b0 | out: hHeap=0x560000) returned 1 [0037.444] lstrlenW (lpString="C:\\") returned 3 [0037.444] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0037.444] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x579888 [0037.444] lstrcmpiW (lpString1="$GetCurrent", lpString2=".") returned -1 [0037.444] lstrcmpiW (lpString1="$GetCurrent", lpString2="..") returned -1 [0037.444] lstrcatW (in: lpString1="C:\\", lpString2="$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0037.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$GetCurrent", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.445] GetProcessHeap () returned 0x560000 [0037.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0037.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$GetCurrent", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$GetCurrent", lpUsedDefaultChar=0x0) returned 12 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0037.445] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.446] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.446] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0037.446] GetProcessHeap () returned 0x560000 [0037.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5788b0 [0037.446] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0037.446] GetProcessHeap () returned 0x560000 [0037.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x20) returned 0x57d5f8 [0037.446] lstrcpyW (in: lpString1=0x57d5f8, lpString2="C:\\$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0037.446] GetProcessHeap () returned 0x560000 [0037.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.446] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0037.446] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0037.446] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0037.446] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0037.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.447] GetProcessHeap () returned 0x560000 [0037.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec10 [0037.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=-1, lpMultiByteStr=0x57ec10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$Recycle.Bin", lpUsedDefaultChar=0x0) returned 13 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0037.447] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.448] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0037.448] GetProcessHeap () returned 0x560000 [0037.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5787a0 [0037.448] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0037.448] GetProcessHeap () returned 0x560000 [0037.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x22) returned 0x5756f0 [0037.448] lstrcpyW (in: lpString1=0x5756f0, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0037.448] GetProcessHeap () returned 0x560000 [0037.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.448] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0037.448] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2=".") returned -1 [0037.448] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="..") returned -1 [0037.448] lstrcatW (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0037.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$WINRE_BACKUP_PARTITION.MARKER", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0037.448] GetProcessHeap () returned 0x560000 [0037.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1f) returned 0x57d3f0 [0037.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$WINRE_BACKUP_PARTITION.MARKER", cchWideChar=-1, lpMultiByteStr=0x57d3f0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$WINRE_BACKUP_PARTITION.MARKER", lpUsedDefaultChar=0x0) returned 31 [0037.449] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0037.449] lstrlenA (lpString=".badday") returned 7 [0037.449] lstrlenA (lpString=".badday") returned 7 [0037.449] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0037.449] lstrcmpiA (lpString1=".MARKER", lpString2=".badday") returned 1 [0037.449] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="how_to_back_files.html") returned -1 [0037.449] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0037.449] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.449] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.449] GetProcessHeap () returned 0x560000 [0037.449] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0037.449] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.450] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=0) returned 1 [0037.450] CloseHandle (hObject=0x230) returned 1 [0037.450] GetProcessHeap () returned 0x560000 [0037.450] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0037.450] GetProcessHeap () returned 0x560000 [0037.450] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0037.450] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0037.450] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2=".") returned 1 [0037.450] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="..") returned 1 [0037.450] lstrcatW (in: lpString1="C:\\", lpString2="588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0037.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="588bce7c90097ed212", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0037.450] GetProcessHeap () returned 0x560000 [0037.450] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5768d8 [0037.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="588bce7c90097ed212", cchWideChar=-1, lpMultiByteStr=0x5768d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="588bce7c90097ed212", lpUsedDefaultChar=0x0) returned 19 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0037.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.452] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0037.452] GetProcessHeap () returned 0x560000 [0037.452] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5786e0 [0037.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0037.452] GetProcessHeap () returned 0x560000 [0037.452] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e) returned 0x582e90 [0037.452] lstrcpyW (in: lpString1=0x582e90, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0037.452] GetProcessHeap () returned 0x560000 [0037.452] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5768d8 | out: hHeap=0x560000) returned 1 [0037.452] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0037.452] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1 [0037.452] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1 [0037.452] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0037.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0037.452] GetProcessHeap () returned 0x560000 [0037.452] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x578710 [0037.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=-1, lpMultiByteStr=0x578710, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boot", lpUsedDefaultChar=0x0) returned 5 [0037.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.454] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0037.454] GetProcessHeap () returned 0x560000 [0037.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0b8 [0037.454] lstrlenW (lpString="C:\\Boot\\") returned 8 [0037.454] GetProcessHeap () returned 0x560000 [0037.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576938 [0037.454] lstrcpyW (in: lpString1=0x576938, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0037.454] GetProcessHeap () returned 0x560000 [0037.454] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578710 | out: hHeap=0x560000) returned 1 [0037.454] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0037.454] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1 [0037.454] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1 [0037.454] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0037.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0037.454] GetProcessHeap () returned 0x560000 [0037.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fe8 [0037.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=-1, lpMultiByteStr=0x589fe8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr", lpUsedDefaultChar=0x0) returned 8 [0037.454] lstrlenA (lpString="bootmgr") returned 7 [0037.454] lstrlenA (lpString=".badday") returned 7 [0037.454] lstrlenA (lpString=".badday") returned 7 [0037.454] lstrlenA (lpString="bootmgr") returned 7 [0037.454] lstrcmpiA (lpString1="bootmgr", lpString2=".badday") returned 1 [0037.454] lstrcmpiW (lpString1="bootmgr", lpString2="how_to_back_files.html") returned -1 [0037.455] lstrcmpiW (lpString1="bootmgr", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.455] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.455] lstrcmpiW (lpString1="bootmgr", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.455] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0037.457] GetProcessHeap () returned 0x560000 [0037.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0037.457] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0037.457] CloseHandle (hObject=0xffffffff) returned 1 [0037.457] GetProcessHeap () returned 0x560000 [0037.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0037.457] GetProcessHeap () returned 0x560000 [0037.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fe8 | out: hHeap=0x560000) returned 1 [0037.457] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0037.457] lstrcmpiW (lpString1="BOOTNXT", lpString2=".") returned 1 [0037.458] lstrcmpiW (lpString1="BOOTNXT", lpString2="..") returned 1 [0037.458] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0037.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTNXT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0037.458] GetProcessHeap () returned 0x560000 [0037.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1c8 [0037.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTNXT", cchWideChar=-1, lpMultiByteStr=0x58a1c8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTNXT", lpUsedDefaultChar=0x0) returned 8 [0037.458] lstrlenA (lpString="BOOTNXT") returned 7 [0037.458] lstrlenA (lpString=".badday") returned 7 [0037.458] lstrlenA (lpString=".badday") returned 7 [0037.458] lstrlenA (lpString="BOOTNXT") returned 7 [0037.458] lstrcmpiA (lpString1="BOOTNXT", lpString2=".badday") returned 1 [0037.458] lstrcmpiW (lpString1="BOOTNXT", lpString2="how_to_back_files.html") returned -1 [0037.458] lstrcmpiW (lpString1="BOOTNXT", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.458] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.458] lstrcmpiW (lpString1="BOOTNXT", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.458] GetProcessHeap () returned 0x560000 [0037.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0037.458] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.460] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1) returned 1 [0037.460] GetProcessHeap () returned 0x560000 [0037.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.460] GetProcessHeap () returned 0x560000 [0037.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.460] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0037.460] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.460] GetProcessHeap () returned 0x560000 [0037.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.460] GetProcessHeap () returned 0x560000 [0037.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x58a5b8 [0037.460] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.460] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0037.461] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.461] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.461] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.461] lstrlenA (lpString="010001") returned 6 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5853e8 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5844b8 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a128 [0037.461] GetProcessHeap () returned 0x560000 [0037.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a128 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584298 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585118 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a950 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585118 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec10 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ae8 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58aa60 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ae8 | out: hHeap=0x560000) returned 1 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fe8 [0037.462] GetProcessHeap () returned 0x560000 [0037.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fe8 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a108 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a108 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a018 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a018 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0c8 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0c8 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a188 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a188 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.463] GetProcessHeap () returned 0x560000 [0037.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a108 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a108 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.464] GetProcessHeap () returned 0x560000 [0037.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fe8 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fe8 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fe8 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fe8 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a128 [0037.465] GetProcessHeap () returned 0x560000 [0037.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a128 | out: hHeap=0x560000) returned 1 [0037.465] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a188 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a188 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a028 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a028 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.466] GetProcessHeap () returned 0x560000 [0037.466] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a950 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aa60 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844b8 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5853e8 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.467] GetProcessHeap () returned 0x560000 [0037.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.467] WriteFile (in: hFile=0x230, lpBuffer=0x58a5b8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a5b8*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0037.471] GetProcessHeap () returned 0x560000 [0037.471] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a5b8, Size=0x30) returned 0x58a5b8 [0037.471] GetProcessHeap () returned 0x560000 [0037.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.471] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.471] GetProcessHeap () returned 0x560000 [0037.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec10 [0037.471] ReadFile (in: hFile=0x230, lpBuffer=0x57ec10, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x57ec10*, lpNumberOfBytesRead=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.471] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.471] WriteFile (in: hFile=0x230, lpBuffer=0x57ec10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x57ec10*, lpNumberOfBytesWritten=0x24ad7e4*=0x10, lpOverlapped=0x0) returned 1 [0037.472] GetProcessHeap () returned 0x560000 [0037.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.472] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.472] WriteFile (in: hFile=0x230, lpBuffer=0x58a5b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a5b8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.473] CloseHandle (hObject=0x230) returned 1 [0037.474] GetProcessHeap () returned 0x560000 [0037.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0037.474] GetProcessHeap () returned 0x560000 [0037.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.474] GetProcessHeap () returned 0x560000 [0037.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.474] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0037.474] lstrcatW (in: lpString1="C:\\BOOTNXT", lpString2=".badday" | out: lpString1="C:\\BOOTNXT.badday") returned="C:\\BOOTNXT.badday" [0037.475] MoveFileExW (lpExistingFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="C:\\BOOTNXT.badday" (normalized: "c:\\bootnxt.badday"), dwFlags=0x1) returned 1 [0037.475] PathRemoveFileSpecW (in: pszPath="C:\\BOOTNXT" | out: pszPath="C:\\") returned 1 [0037.475] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0037.475] lstrcatW (in: lpString1="C:\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\how_to_back_files.html") returned="C:\\how_to_back_files.html" [0037.475] GetFileAttributesW (lpFileName="C:\\how_to_back_files.html" (normalized: "c:\\how_to_back_files.html")) returned 0xffffffff [0037.475] CreateFileW (lpFileName="C:\\how_to_back_files.html" (normalized: "c:\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0037.476] GetProcessHeap () returned 0x560000 [0037.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.476] GetProcessHeap () returned 0x560000 [0037.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.483] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.484] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.484] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.485] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.486] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.487] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.488] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.489] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.495] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.495] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.495] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.495] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.495] GetProcessHeap () returned 0x560000 [0037.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.495] GetProcessHeap () returned 0x560000 [0037.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.495] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0037.495] GetProcessHeap () returned 0x560000 [0037.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.495] GetProcessHeap () returned 0x560000 [0037.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.522] GetProcessHeap () returned 0x560000 [0037.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.522] GetProcessHeap () returned 0x560000 [0037.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.522] CloseHandle (hObject=0x230) returned 1 [0037.523] GetProcessHeap () returned 0x560000 [0037.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0037.523] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0037.523] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0037.523] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0037.523] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0037.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.524] GetProcessHeap () returned 0x560000 [0037.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0037.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSECT.BAK", lpUsedDefaultChar=0x0) returned 13 [0037.524] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0037.524] lstrlenA (lpString=".badday") returned 7 [0037.524] lstrlenA (lpString=".badday") returned 7 [0037.524] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0037.524] lstrcmpiA (lpString1="ECT.BAK", lpString2=".badday") returned 1 [0037.524] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="how_to_back_files.html") returned -1 [0037.524] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.524] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.524] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.524] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0037.524] GetProcessHeap () returned 0x560000 [0037.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0037.524] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.524] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=8192) returned 1 [0037.525] GetProcessHeap () returned 0x560000 [0037.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.525] GetProcessHeap () returned 0x560000 [0037.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.525] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.525] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.525] GetProcessHeap () returned 0x560000 [0037.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.525] GetProcessHeap () returned 0x560000 [0037.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58a5f0 [0037.525] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.525] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0037.525] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.525] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.525] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.525] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.526] lstrlenA (lpString="010001") returned 6 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c08 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5844b8 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a188 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a188 | out: hHeap=0x560000) returned 1 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584298 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec10 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5849c8 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a978 [0037.526] GetProcessHeap () returned 0x560000 [0037.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58aad0 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ff8 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aad0 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58ae90 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ff8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.527] GetProcessHeap () returned 0x560000 [0037.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.527] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0c8 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0c8 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a188 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a188 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a018 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a018 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fe8 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fe8 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a188 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a188 | out: hHeap=0x560000) returned 1 [0037.528] GetProcessHeap () returned 0x560000 [0037.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.528] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0c8 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0c8 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fe8 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fe8 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.529] GetProcessHeap () returned 0x560000 [0037.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.529] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0c8 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0c8 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a188 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a188 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.530] GetProcessHeap () returned 0x560000 [0037.530] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a108 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a108 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a978 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae90 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec10 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844b8 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.531] GetProcessHeap () returned 0x560000 [0037.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c08 | out: hHeap=0x560000) returned 1 [0037.532] GetProcessHeap () returned 0x560000 [0037.532] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.532] GetProcessHeap () returned 0x560000 [0037.532] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.532] GetProcessHeap () returned 0x560000 [0037.532] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.532] WriteFile (in: hFile=0x230, lpBuffer=0x58a5f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a5f0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0037.535] GetProcessHeap () returned 0x560000 [0037.535] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a5f0, Size=0x30) returned 0x58a5f0 [0037.535] GetProcessHeap () returned 0x560000 [0037.535] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.535] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.535] GetProcessHeap () returned 0x560000 [0037.535] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2000) returned 0x58ae90 [0037.535] ReadFile (in: hFile=0x230, lpBuffer=0x58ae90, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesRead=0x24ad7e8*=0x2000, lpOverlapped=0x0) returned 1 [0037.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.536] WriteFile (in: hFile=0x230, lpBuffer=0x58ae90*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesWritten=0x24ad7e4*=0x2000, lpOverlapped=0x0) returned 1 [0037.548] GetProcessHeap () returned 0x560000 [0037.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae90 | out: hHeap=0x560000) returned 1 [0037.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.548] WriteFile (in: hFile=0x230, lpBuffer=0x58a5f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a5f0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.549] CloseHandle (hObject=0x230) returned 1 [0037.551] GetProcessHeap () returned 0x560000 [0037.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0037.551] GetProcessHeap () returned 0x560000 [0037.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.551] GetProcessHeap () returned 0x560000 [0037.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.551] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0037.551] lstrcatW (in: lpString1="C:\\BOOTSECT.BAK", lpString2=".badday" | out: lpString1="C:\\BOOTSECT.BAK.badday") returned="C:\\BOOTSECT.BAK.badday" [0037.551] MoveFileExW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.badday" (normalized: "c:\\bootsect.bak.badday"), dwFlags=0x1) returned 1 [0037.551] PathRemoveFileSpecW (in: pszPath="C:\\BOOTSECT.BAK" | out: pszPath="C:\\") returned 1 [0037.551] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0037.551] lstrcatW (in: lpString1="C:\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\how_to_back_files.html") returned="C:\\how_to_back_files.html" [0037.551] GetFileAttributesW (lpFileName="C:\\how_to_back_files.html" (normalized: "c:\\how_to_back_files.html")) returned 0x20 [0037.552] GetProcessHeap () returned 0x560000 [0037.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.552] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0037.552] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1 [0037.552] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1 [0037.552] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0037.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0037.552] GetProcessHeap () returned 0x560000 [0037.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576a58 [0037.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents and Settings", lpUsedDefaultChar=0x0) returned 23 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.553] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0037.553] GetProcessHeap () returned 0x560000 [0037.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a018 [0037.553] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0037.553] GetProcessHeap () returned 0x560000 [0037.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579648 [0037.553] lstrcpyW (in: lpString1=0x579648, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0037.553] GetProcessHeap () returned 0x560000 [0037.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0037.554] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0037.554] lstrcmpiW (lpString1="ESD", lpString2=".") returned 1 [0037.554] lstrcmpiW (lpString1="ESD", lpString2="..") returned 1 [0037.554] lstrcatW (in: lpString1="C:\\", lpString2="ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD" [0037.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESD", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0037.554] GetProcessHeap () returned 0x560000 [0037.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x58a068 [0037.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESD", cchWideChar=-1, lpMultiByteStr=0x58a068, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESD", lpUsedDefaultChar=0x0) returned 4 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.555] lstrcatW (in: lpString1="C:\\ESD", lpString2="\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\" [0037.555] GetProcessHeap () returned 0x560000 [0037.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a188 [0037.555] lstrlenW (lpString="C:\\ESD\\") returned 7 [0037.555] GetProcessHeap () returned 0x560000 [0037.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec10 [0037.555] lstrcpyW (in: lpString1=0x57ec10, lpString2="C:\\ESD\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\" [0037.555] GetProcessHeap () returned 0x560000 [0037.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.555] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0037.555] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0037.555] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0037.556] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0037.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.556] GetProcessHeap () returned 0x560000 [0037.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0037.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 13 [0037.556] lstrlenA (lpString="hiberfil.sys") returned 12 [0037.556] lstrlenA (lpString=".badday") returned 7 [0037.556] lstrlenA (lpString=".badday") returned 7 [0037.556] lstrlenA (lpString="hiberfil.sys") returned 12 [0037.556] lstrcmpiA (lpString1="fil.sys", lpString2=".badday") returned 1 [0037.556] lstrcmpiW (lpString1="hiberfil.sys", lpString2="how_to_back_files.html") returned -1 [0037.556] lstrcmpiW (lpString1="hiberfil.sys", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.556] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.556] lstrcmpiW (lpString1="hiberfil.sys", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.556] GetProcessHeap () returned 0x560000 [0037.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0037.556] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0037.557] CloseHandle (hObject=0xffffffff) returned 1 [0037.557] GetProcessHeap () returned 0x560000 [0037.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0037.557] GetProcessHeap () returned 0x560000 [0037.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.557] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0037.557] lstrcmpiW (lpString1="Logs", lpString2=".") returned 1 [0037.557] lstrcmpiW (lpString1="Logs", lpString2="..") returned 1 [0037.557] lstrcatW (in: lpString1="C:\\", lpString2="Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs" [0037.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Logs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0037.557] GetProcessHeap () returned 0x560000 [0037.557] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a028 [0037.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Logs", cchWideChar=-1, lpMultiByteStr=0x58a028, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Logs", lpUsedDefaultChar=0x0) returned 5 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.557] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.558] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.559] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.559] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.559] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.559] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.559] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0037.559] GetProcessHeap () returned 0x560000 [0037.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a108 [0037.559] lstrlenW (lpString="C:\\Logs\\") returned 8 [0037.559] GetProcessHeap () returned 0x560000 [0037.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576958 [0037.559] lstrcpyW (in: lpString1=0x576958, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0037.559] GetProcessHeap () returned 0x560000 [0037.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a028 | out: hHeap=0x560000) returned 1 [0037.559] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0037.559] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1 [0037.559] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1 [0037.559] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0037.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.559] GetProcessHeap () returned 0x560000 [0037.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0037.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 13 [0037.559] lstrlenA (lpString="pagefile.sys") returned 12 [0037.559] lstrlenA (lpString=".badday") returned 7 [0037.559] lstrlenA (lpString=".badday") returned 7 [0037.559] lstrlenA (lpString="pagefile.sys") returned 12 [0037.559] lstrcmpiA (lpString1="ile.sys", lpString2=".badday") returned 1 [0037.559] lstrcmpiW (lpString1="pagefile.sys", lpString2="how_to_back_files.html") returned 1 [0037.559] lstrcmpiW (lpString1="pagefile.sys", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.559] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.559] lstrcmpiW (lpString1="pagefile.sys", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0037.559] GetProcessHeap () returned 0x560000 [0037.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d210 [0037.559] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0037.560] CloseHandle (hObject=0xffffffff) returned 1 [0037.560] GetProcessHeap () returned 0x560000 [0037.560] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d210 | out: hHeap=0x560000) returned 1 [0037.560] GetProcessHeap () returned 0x560000 [0037.560] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.560] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0037.560] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1 [0037.560] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1 [0037.560] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0037.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.560] GetProcessHeap () returned 0x560000 [0037.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0037.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfLogs", lpUsedDefaultChar=0x0) returned 9 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.560] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.561] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.562] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0037.562] GetProcessHeap () returned 0x560000 [0037.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a128 [0037.562] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0037.562] GetProcessHeap () returned 0x560000 [0037.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x57d3a0 [0037.562] lstrcpyW (in: lpString1=0x57d3a0, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0037.562] GetProcessHeap () returned 0x560000 [0037.562] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.562] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x57ae7feb, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x57ae7feb, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0037.562] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1 [0037.562] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1 [0037.562] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0037.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0037.562] GetProcessHeap () returned 0x560000 [0037.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0037.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files", lpUsedDefaultChar=0x0) returned 14 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.562] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.563] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.563] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0037.563] GetProcessHeap () returned 0x560000 [0037.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a028 [0037.564] lstrlenW (lpString="C:\\Program Files\\") returned 17 [0037.564] GetProcessHeap () returned 0x560000 [0037.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x24) returned 0x5759f0 [0037.564] lstrcpyW (in: lpString1=0x5759f0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0037.564] GetProcessHeap () returned 0x560000 [0037.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.564] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0037.564] lstrcmpiW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0037.564] lstrcmpiW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0037.564] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0037.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0037.564] GetProcessHeap () returned 0x560000 [0037.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5769f8 [0037.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files (x86)", lpUsedDefaultChar=0x0) returned 20 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.564] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.565] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.565] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0037.565] GetProcessHeap () returned 0x560000 [0037.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fe8 [0037.565] lstrlenW (lpString="C:\\Program Files (x86)\\") returned 23 [0037.565] GetProcessHeap () returned 0x560000 [0037.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x30) returned 0x5828e0 [0037.565] lstrcpyW (in: lpString1=0x5828e0, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0037.565] GetProcessHeap () returned 0x560000 [0037.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0037.565] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0037.565] lstrcmpiW (lpString1="ProgramData", lpString2=".") returned 1 [0037.566] lstrcmpiW (lpString1="ProgramData", lpString2="..") returned 1 [0037.566] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0037.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.566] GetProcessHeap () returned 0x560000 [0037.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0037.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData", lpUsedDefaultChar=0x0) returned 12 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.566] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 2 [0037.567] GetProcessHeap () returned 0x560000 [0037.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.567] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0037.567] lstrcmpiW (lpString1="Recovery", lpString2=".") returned 1 [0037.567] lstrcmpiW (lpString1="Recovery", lpString2="..") returned 1 [0037.567] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0037.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recovery", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.567] GetProcessHeap () returned 0x560000 [0037.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0037.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recovery", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recovery", lpUsedDefaultChar=0x0) returned 9 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.567] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.568] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.569] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.569] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.569] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0037.569] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0037.569] GetProcessHeap () returned 0x560000 [0037.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0c8 [0037.569] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0037.569] GetProcessHeap () returned 0x560000 [0037.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x57d210 [0037.569] lstrcpyW (in: lpString1=0x57d210, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0037.569] GetProcessHeap () returned 0x560000 [0037.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.569] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0037.569] lstrcmpiW (lpString1="swapfile.sys", lpString2=".") returned 1 [0037.569] lstrcmpiW (lpString1="swapfile.sys", lpString2="..") returned 1 [0037.569] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0037.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swapfile.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.569] GetProcessHeap () returned 0x560000 [0037.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0037.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swapfile.sys", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swapfile.sys", lpUsedDefaultChar=0x0) returned 13 [0037.569] lstrlenA (lpString="swapfile.sys") returned 12 [0037.569] lstrlenA (lpString=".badday") returned 7 [0037.569] lstrlenA (lpString=".badday") returned 7 [0037.569] lstrlenA (lpString="swapfile.sys") returned 12 [0037.569] lstrcmpiA (lpString1="ile.sys", lpString2=".badday") returned 1 [0037.569] lstrcmpiW (lpString1="swapfile.sys", lpString2="how_to_back_files.html") returned 1 [0037.569] lstrcmpiW (lpString1="swapfile.sys", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.569] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.569] lstrcmpiW (lpString1="swapfile.sys", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0037.569] GetProcessHeap () returned 0x560000 [0037.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0037.569] CreateFileW (lpFileName="C:\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0037.570] CloseHandle (hObject=0xffffffff) returned 1 [0037.570] GetProcessHeap () returned 0x560000 [0037.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0037.570] GetProcessHeap () returned 0x560000 [0037.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.570] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0037.570] lstrcmpiW (lpString1="System Volume Information", lpString2=".") returned 1 [0037.570] lstrcmpiW (lpString1="System Volume Information", lpString2="..") returned 1 [0037.570] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0037.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System Volume Information", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0037.570] GetProcessHeap () returned 0x560000 [0037.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x57d378 [0037.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System Volume Information", cchWideChar=-1, lpMultiByteStr=0x57d378, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System Volume Information", lpUsedDefaultChar=0x0) returned 26 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.570] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 2 [0037.571] GetProcessHeap () returned 0x560000 [0037.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0037.571] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0037.571] lstrcmpiW (lpString1="Users", lpString2=".") returned 1 [0037.571] lstrcmpiW (lpString1="Users", lpString2="..") returned 1 [0037.571] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0037.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0037.571] GetProcessHeap () returned 0x560000 [0037.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a0d8 [0037.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=-1, lpMultiByteStr=0x58a0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 6 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.571] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.572] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0037.572] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0037.573] GetProcessHeap () returned 0x560000 [0037.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a048 [0037.573] lstrlenW (lpString="C:\\Users\\") returned 9 [0037.573] GetProcessHeap () returned 0x560000 [0037.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5768b8 [0037.573] lstrcpyW (in: lpString1=0x5768b8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0037.573] GetProcessHeap () returned 0x560000 [0037.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.573] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0037.573] lstrcmpiW (lpString1="Windows", lpString2=".") returned 1 [0037.573] lstrcmpiW (lpString1="Windows", lpString2="..") returned 1 [0037.573] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0037.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0037.573] GetProcessHeap () returned 0x560000 [0037.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1b8 [0037.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows", cchWideChar=-1, lpMultiByteStr=0x58a1b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows", lpUsedDefaultChar=0x0) returned 8 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 2 [0037.573] GetProcessHeap () returned 0x560000 [0037.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.573] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0037.573] lstrcmpiW (lpString1="Windows10Upgrade", lpString2=".") returned 1 [0037.573] lstrcmpiW (lpString1="Windows10Upgrade", lpString2="..") returned 1 [0037.573] lstrcatW (in: lpString1="C:\\", lpString2="Windows10Upgrade" | out: lpString1="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0037.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10Upgrade", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0037.573] GetProcessHeap () returned 0x560000 [0037.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x5769f8 [0037.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10Upgrade", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows10Upgrade", lpUsedDefaultChar=0x0) returned 17 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0037.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0037.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0037.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0037.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0037.575] lstrcatW (in: lpString1="C:\\Windows10Upgrade", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0037.575] GetProcessHeap () returned 0x560000 [0037.575] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d8 [0037.575] lstrlenW (lpString="C:\\Windows10Upgrade\\") returned 20 [0037.575] GetProcessHeap () returned 0x560000 [0037.575] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2a) returned 0x582e20 [0037.575] lstrcpyW (in: lpString1=0x582e20, lpString2="C:\\Windows10Upgrade\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0037.575] GetProcessHeap () returned 0x560000 [0037.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0037.575] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0037.575] FindClose (in: hFindFile=0x579888 | out: hFindFile=0x579888) returned 1 [0037.575] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0037.575] GetProcessHeap () returned 0x560000 [0037.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582e20 | out: hHeap=0x560000) returned 1 [0037.575] GetProcessHeap () returned 0x560000 [0037.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.575] lstrlenW (lpString="C:\\Windows10Upgrade\\") returned 20 [0037.575] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\*") returned="C:\\Windows10Upgrade\\*" [0037.575] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579748 [0037.578] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0037.578] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.579] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0037.579] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0037.579] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0037.579] lstrcmpiW (lpString1="2052", lpString2=".") returned 1 [0037.579] lstrcmpiW (lpString1="2052", lpString2="..") returned 1 [0037.579] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="2052" | out: lpString1="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0037.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2052", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0037.579] GetProcessHeap () returned 0x560000 [0037.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a098 [0037.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2052", cchWideChar=-1, lpMultiByteStr=0x58a098, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2052", lpUsedDefaultChar=0x0) returned 5 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0037.579] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0037.580] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0037.580] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0037.580] GetProcessHeap () returned 0x560000 [0037.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a148 [0037.581] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\") returned 25 [0037.581] GetProcessHeap () returned 0x560000 [0037.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579448 [0037.581] lstrcpyW (in: lpString1=0x579448, lpString2="C:\\Windows10Upgrade\\2052\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0037.581] GetProcessHeap () returned 0x560000 [0037.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.581] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0037.581] lstrcmpiW (lpString1="appraiserxp.dll", lpString2=".") returned 1 [0037.581] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="..") returned 1 [0037.581] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="appraiserxp.dll" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll") returned="C:\\Windows10Upgrade\\appraiserxp.dll" [0037.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appraiserxp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0037.581] GetProcessHeap () returned 0x560000 [0037.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0037.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appraiserxp.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appraiserxp.dll", lpUsedDefaultChar=0x0) returned 16 [0037.581] lstrlenA (lpString="appraiserxp.dll") returned 15 [0037.581] lstrlenA (lpString=".badday") returned 7 [0037.581] lstrlenA (lpString=".badday") returned 7 [0037.581] lstrlenA (lpString="appraiserxp.dll") returned 15 [0037.581] lstrcmpiA (lpString1="rxp.dll", lpString2=".badday") returned 1 [0037.581] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="how_to_back_files.html") returned -1 [0037.581] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.581] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.581] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.581] GetProcessHeap () returned 0x560000 [0037.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0037.581] CreateFileW (lpFileName="C:\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.582] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=459976) returned 1 [0037.582] GetProcessHeap () returned 0x560000 [0037.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.582] GetProcessHeap () returned 0x560000 [0037.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.582] lstrlenW (lpString="C:\\Windows10Upgrade\\appraiserxp.dll") returned 35 [0037.582] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.582] GetProcessHeap () returned 0x560000 [0037.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.582] GetProcessHeap () returned 0x560000 [0037.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58a628 [0037.583] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.583] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0037.583] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.583] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.583] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.583] GetProcessHeap () returned 0x560000 [0037.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.583] lstrlenA (lpString="010001") returned 6 [0037.583] GetProcessHeap () returned 0x560000 [0037.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0037.583] GetProcessHeap () returned 0x560000 [0037.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.583] GetProcessHeap () returned 0x560000 [0037.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846f8 [0037.583] GetProcessHeap () returned 0x560000 [0037.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.583] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ed8 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584298 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58add0 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5845d8 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58ae90 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5845d8 | out: hHeap=0x560000) returned 1 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58ae00 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5852c8 [0037.584] GetProcessHeap () returned 0x560000 [0037.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae00 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58afa0 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5852c8 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0037.585] GetProcessHeap () returned 0x560000 [0037.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.586] GetProcessHeap () returned 0x560000 [0037.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.586] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.587] GetProcessHeap () returned 0x560000 [0037.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.588] GetProcessHeap () returned 0x560000 [0037.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae90 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58afa0 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58add0 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ed8 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846f8 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.589] GetProcessHeap () returned 0x560000 [0037.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.589] WriteFile (in: hFile=0x230, lpBuffer=0x58a628*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a628*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0037.641] GetProcessHeap () returned 0x560000 [0037.641] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a628, Size=0x30) returned 0x58a628 [0037.641] GetProcessHeap () returned 0x560000 [0037.641] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.641] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.641] GetProcessHeap () returned 0x560000 [0037.641] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x704d0) returned 0x58ae90 [0037.648] ReadFile (in: hFile=0x230, lpBuffer=0x58ae90, nNumberOfBytesToRead=0x704d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesRead=0x24ad7e8*=0x704d0, lpOverlapped=0x0) returned 1 [0037.656] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.656] WriteFile (in: hFile=0x230, lpBuffer=0x58ae90*, nNumberOfBytesToWrite=0x704d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesWritten=0x24ad7e4*=0x704d0, lpOverlapped=0x0) returned 1 [0037.696] GetProcessHeap () returned 0x560000 [0037.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae90 | out: hHeap=0x560000) returned 1 [0037.696] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.696] WriteFile (in: hFile=0x230, lpBuffer=0x58a628*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a628*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.697] CloseHandle (hObject=0x230) returned 1 [0037.705] GetProcessHeap () returned 0x560000 [0037.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0037.705] GetProcessHeap () returned 0x560000 [0037.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.705] GetProcessHeap () returned 0x560000 [0037.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.705] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\appraiserxp.dll" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll") returned="C:\\Windows10Upgrade\\appraiserxp.dll" [0037.705] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll.badday") returned="C:\\Windows10Upgrade\\appraiserxp.dll.badday" [0037.705] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), lpNewFileName="C:\\Windows10Upgrade\\appraiserxp.dll.badday" (normalized: "c:\\windows10upgrade\\appraiserxp.dll.badday"), dwFlags=0x1) returned 1 [0037.706] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\appraiserxp.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0037.706] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0037.706] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0037.706] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0xffffffff [0037.706] CreateFileW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0037.707] GetProcessHeap () returned 0x560000 [0037.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.707] GetProcessHeap () returned 0x560000 [0037.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.716] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.717] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.717] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.717] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.717] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.745] GetProcessHeap () returned 0x560000 [0037.745] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.745] GetProcessHeap () returned 0x560000 [0037.745] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.745] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0037.745] GetProcessHeap () returned 0x560000 [0037.745] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.745] GetProcessHeap () returned 0x560000 [0037.745] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0037.834] GetProcessHeap () returned 0x560000 [0037.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.834] GetProcessHeap () returned 0x560000 [0037.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.834] CloseHandle (hObject=0x230) returned 1 [0037.834] GetProcessHeap () returned 0x560000 [0037.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.834] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0037.834] lstrcmpiW (lpString1="bootsect.exe", lpString2=".") returned 1 [0037.834] lstrcmpiW (lpString1="bootsect.exe", lpString2="..") returned 1 [0037.834] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="bootsect.exe" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0037.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootsect.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.834] GetProcessHeap () returned 0x560000 [0037.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0037.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootsect.exe", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootsect.exe", lpUsedDefaultChar=0x0) returned 13 [0037.834] lstrlenA (lpString="bootsect.exe") returned 12 [0037.834] lstrlenA (lpString=".badday") returned 7 [0037.834] lstrlenA (lpString=".badday") returned 7 [0037.835] lstrlenA (lpString="bootsect.exe") returned 12 [0037.835] lstrcmpiA (lpString1="ect.exe", lpString2=".badday") returned 1 [0037.835] lstrcmpiW (lpString1="bootsect.exe", lpString2="how_to_back_files.html") returned -1 [0037.835] lstrcmpiW (lpString1="bootsect.exe", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.835] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.835] lstrcmpiW (lpString1="bootsect.exe", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.835] GetProcessHeap () returned 0x560000 [0037.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0037.835] CreateFileW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.835] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=118472) returned 1 [0037.835] GetProcessHeap () returned 0x560000 [0037.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.835] GetProcessHeap () returned 0x560000 [0037.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.835] lstrlenW (lpString="C:\\Windows10Upgrade\\bootsect.exe") returned 32 [0037.835] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.835] GetProcessHeap () returned 0x560000 [0037.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.835] GetProcessHeap () returned 0x560000 [0037.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58a660 [0037.836] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.836] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58a9f0) returned 1 [0037.836] CryptGenRandom (in: hProv=0x58a9f0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.836] CryptReleaseContext (hProv=0x58a9f0, dwFlags=0x0) returned 1 [0037.836] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.836] GetProcessHeap () returned 0x560000 [0037.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58a9f0 [0037.836] lstrlenA (lpString="010001") returned 6 [0037.836] GetProcessHeap () returned 0x560000 [0037.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0037.836] GetProcessHeap () returned 0x560000 [0037.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.836] GetProcessHeap () returned 0x560000 [0037.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846f8 [0037.836] GetProcessHeap () returned 0x560000 [0037.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.836] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5849c8 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58acf8 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ed8 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ed8 | out: hHeap=0x560000) returned 1 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58ac20 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.837] GetProcessHeap () returned 0x560000 [0037.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ae8 [0037.837] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ac20 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58ae90 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ae8 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.838] GetProcessHeap () returned 0x560000 [0037.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0037.838] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.839] GetProcessHeap () returned 0x560000 [0037.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.839] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.840] GetProcessHeap () returned 0x560000 [0037.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.840] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.841] GetProcessHeap () returned 0x560000 [0037.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.841] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae90 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58acf8 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846f8 | out: hHeap=0x560000) returned 1 [0037.842] GetProcessHeap () returned 0x560000 [0037.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.843] GetProcessHeap () returned 0x560000 [0037.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0037.843] GetProcessHeap () returned 0x560000 [0037.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a9f0 | out: hHeap=0x560000) returned 1 [0037.843] WriteFile (in: hFile=0x230, lpBuffer=0x58a660*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a660*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0037.863] GetProcessHeap () returned 0x560000 [0037.863] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a660, Size=0x30) returned 0x58a660 [0037.863] GetProcessHeap () returned 0x560000 [0037.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.863] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.863] GetProcessHeap () returned 0x560000 [0037.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1ced0) returned 0x58ae90 [0037.863] ReadFile (in: hFile=0x230, lpBuffer=0x58ae90, nNumberOfBytesToRead=0x1ced0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesRead=0x24ad7e8*=0x1ced0, lpOverlapped=0x0) returned 1 [0037.866] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.866] WriteFile (in: hFile=0x230, lpBuffer=0x58ae90*, nNumberOfBytesToWrite=0x1ced0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesWritten=0x24ad7e4*=0x1ced0, lpOverlapped=0x0) returned 1 [0037.877] GetProcessHeap () returned 0x560000 [0037.877] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ae90 | out: hHeap=0x560000) returned 1 [0037.877] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.877] WriteFile (in: hFile=0x230, lpBuffer=0x58a660*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a660*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.878] CloseHandle (hObject=0x230) returned 1 [0037.881] GetProcessHeap () returned 0x560000 [0037.881] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0037.881] GetProcessHeap () returned 0x560000 [0037.881] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.881] GetProcessHeap () returned 0x560000 [0037.881] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.881] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\bootsect.exe" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0037.881] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\bootsect.exe", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe.badday") returned="C:\\Windows10Upgrade\\bootsect.exe.badday" [0037.882] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), lpNewFileName="C:\\Windows10Upgrade\\bootsect.exe.badday" (normalized: "c:\\windows10upgrade\\bootsect.exe.badday"), dwFlags=0x1) returned 1 [0037.882] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\bootsect.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0037.882] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0037.882] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0037.882] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0037.882] GetProcessHeap () returned 0x560000 [0037.882] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.882] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0037.882] lstrcmpiW (lpString1="Configuration.ini", lpString2=".") returned 1 [0037.882] lstrcmpiW (lpString1="Configuration.ini", lpString2="..") returned 1 [0037.882] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Configuration.ini" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0037.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Configuration.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0037.882] GetProcessHeap () returned 0x560000 [0037.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576b18 [0037.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Configuration.ini", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Configuration.ini", lpUsedDefaultChar=0x0) returned 18 [0037.883] lstrlenA (lpString="Configuration.ini") returned 17 [0037.883] lstrlenA (lpString=".badday") returned 7 [0037.883] lstrlenA (lpString=".badday") returned 7 [0037.883] lstrlenA (lpString="Configuration.ini") returned 17 [0037.883] lstrcmpiA (lpString1="ion.ini", lpString2=".badday") returned 1 [0037.883] lstrcmpiW (lpString1="Configuration.ini", lpString2="how_to_back_files.html") returned -1 [0037.883] lstrcmpiW (lpString1="Configuration.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.883] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.883] lstrcmpiW (lpString1="Configuration.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.883] GetProcessHeap () returned 0x560000 [0037.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0037.883] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.883] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=212) returned 1 [0037.883] GetProcessHeap () returned 0x560000 [0037.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.883] GetProcessHeap () returned 0x560000 [0037.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.883] lstrlenW (lpString="C:\\Windows10Upgrade\\Configuration.ini") returned 37 [0037.883] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.883] GetProcessHeap () returned 0x560000 [0037.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.883] GetProcessHeap () returned 0x560000 [0037.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x58a698 [0037.883] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.884] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0037.884] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.884] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.884] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.884] GetProcessHeap () returned 0x560000 [0037.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.884] lstrlenA (lpString="010001") returned 6 [0037.884] GetProcessHeap () returned 0x560000 [0037.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0037.884] GetProcessHeap () returned 0x560000 [0037.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.884] GetProcessHeap () returned 0x560000 [0037.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585358 [0037.884] GetProcessHeap () returned 0x560000 [0037.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.884] GetProcessHeap () returned 0x560000 [0037.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584788 [0037.884] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584d28 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d28 | out: hHeap=0x560000) returned 1 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b118 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ae8 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b118 | out: hHeap=0x560000) returned 1 [0037.885] GetProcessHeap () returned 0x560000 [0037.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58b298 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ae8 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.886] GetProcessHeap () returned 0x560000 [0037.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.886] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.887] GetProcessHeap () returned 0x560000 [0037.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.888] GetProcessHeap () returned 0x560000 [0037.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.888] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.889] GetProcessHeap () returned 0x560000 [0037.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.889] GetProcessHeap () returned 0x560000 [0037.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0037.890] GetProcessHeap () returned 0x560000 [0037.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0037.890] GetProcessHeap () returned 0x560000 [0037.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.890] GetProcessHeap () returned 0x560000 [0037.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.890] GetProcessHeap () returned 0x560000 [0037.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0037.890] GetProcessHeap () returned 0x560000 [0037.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b298 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584788 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.892] GetProcessHeap () returned 0x560000 [0037.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.892] WriteFile (in: hFile=0x230, lpBuffer=0x58a698*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a698*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0037.896] GetProcessHeap () returned 0x560000 [0037.896] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a698, Size=0x30) returned 0x58a698 [0037.896] GetProcessHeap () returned 0x560000 [0037.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.896] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.896] GetProcessHeap () returned 0x560000 [0037.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe0) returned 0x5728f8 [0037.896] ReadFile (in: hFile=0x230, lpBuffer=0x5728f8, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5728f8*, lpNumberOfBytesRead=0x24ad7e8*=0xe0, lpOverlapped=0x0) returned 1 [0037.896] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.896] WriteFile (in: hFile=0x230, lpBuffer=0x5728f8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5728f8*, lpNumberOfBytesWritten=0x24ad7e4*=0xe0, lpOverlapped=0x0) returned 1 [0037.897] GetProcessHeap () returned 0x560000 [0037.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5728f8 | out: hHeap=0x560000) returned 1 [0037.897] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.897] WriteFile (in: hFile=0x230, lpBuffer=0x58a698*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a698*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.898] CloseHandle (hObject=0x230) returned 1 [0037.899] GetProcessHeap () returned 0x560000 [0037.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0037.899] GetProcessHeap () returned 0x560000 [0037.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.899] GetProcessHeap () returned 0x560000 [0037.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.899] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\Configuration.ini" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0037.899] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\Configuration.ini", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini.badday") returned="C:\\Windows10Upgrade\\Configuration.ini.badday" [0037.899] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), lpNewFileName="C:\\Windows10Upgrade\\Configuration.ini.badday" (normalized: "c:\\windows10upgrade\\configuration.ini.badday"), dwFlags=0x1) returned 1 [0037.900] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\Configuration.ini" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0037.900] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0037.900] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0037.900] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0037.900] GetProcessHeap () returned 0x560000 [0037.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b18 | out: hHeap=0x560000) returned 1 [0037.900] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0037.900] lstrcmpiW (lpString1="cosquery.dll", lpString2=".") returned 1 [0037.900] lstrcmpiW (lpString1="cosquery.dll", lpString2="..") returned 1 [0037.900] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="cosquery.dll" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll") returned="C:\\Windows10Upgrade\\cosquery.dll" [0037.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosquery.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.900] GetProcessHeap () returned 0x560000 [0037.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0037.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosquery.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cosquery.dll", lpUsedDefaultChar=0x0) returned 13 [0037.900] lstrlenA (lpString="cosquery.dll") returned 12 [0037.900] lstrlenA (lpString=".badday") returned 7 [0037.900] lstrlenA (lpString=".badday") returned 7 [0037.900] lstrlenA (lpString="cosquery.dll") returned 12 [0037.900] lstrcmpiA (lpString1="ery.dll", lpString2=".badday") returned 1 [0037.900] lstrcmpiW (lpString1="cosquery.dll", lpString2="how_to_back_files.html") returned -1 [0037.900] lstrcmpiW (lpString1="cosquery.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.901] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.901] lstrcmpiW (lpString1="cosquery.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.901] GetProcessHeap () returned 0x560000 [0037.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0037.901] CreateFileW (lpFileName="C:\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.901] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=61640) returned 1 [0037.901] GetProcessHeap () returned 0x560000 [0037.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.901] GetProcessHeap () returned 0x560000 [0037.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.901] lstrlenW (lpString="C:\\Windows10Upgrade\\cosquery.dll") returned 32 [0037.901] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.901] GetProcessHeap () returned 0x560000 [0037.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.901] GetProcessHeap () returned 0x560000 [0037.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58a6d0 [0037.901] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.901] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0037.902] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.902] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.902] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.902] lstrlenA (lpString="010001") returned 6 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584db8 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b78 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0037.902] GetProcessHeap () returned 0x560000 [0037.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58afb0 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c98 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b130 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5845d8 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b130 | out: hHeap=0x560000) returned 1 [0037.903] GetProcessHeap () returned 0x560000 [0037.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58b298 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5845d8 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.905] GetProcessHeap () returned 0x560000 [0037.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.906] GetProcessHeap () returned 0x560000 [0037.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.907] GetProcessHeap () returned 0x560000 [0037.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.908] GetProcessHeap () returned 0x560000 [0037.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0037.908] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b298 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58afb0 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db8 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.909] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.909] GetProcessHeap () returned 0x560000 [0037.910] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.910] WriteFile (in: hFile=0x230, lpBuffer=0x58a6d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a6d0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0037.918] GetProcessHeap () returned 0x560000 [0037.918] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a6d0, Size=0x30) returned 0x58a6d0 [0037.918] GetProcessHeap () returned 0x560000 [0037.918] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.918] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.918] GetProcessHeap () returned 0x560000 [0037.918] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf0c8) returned 0x58b298 [0037.919] ReadFile (in: hFile=0x230, lpBuffer=0x58b298, nNumberOfBytesToRead=0xf0c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58b298*, lpNumberOfBytesRead=0x24ad7e8*=0xf0c8, lpOverlapped=0x0) returned 1 [0037.921] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.921] WriteFile (in: hFile=0x230, lpBuffer=0x58b298*, nNumberOfBytesToWrite=0xf0c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58b298*, lpNumberOfBytesWritten=0x24ad7e4*=0xf0c8, lpOverlapped=0x0) returned 1 [0037.929] GetProcessHeap () returned 0x560000 [0037.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b298 | out: hHeap=0x560000) returned 1 [0037.929] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.930] WriteFile (in: hFile=0x230, lpBuffer=0x58a6d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a6d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.930] CloseHandle (hObject=0x230) returned 1 [0037.933] GetProcessHeap () returned 0x560000 [0037.933] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0037.933] GetProcessHeap () returned 0x560000 [0037.933] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0037.933] GetProcessHeap () returned 0x560000 [0037.933] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0037.933] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\cosquery.dll" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll") returned="C:\\Windows10Upgrade\\cosquery.dll" [0037.933] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\cosquery.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll.badday") returned="C:\\Windows10Upgrade\\cosquery.dll.badday" [0037.933] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), lpNewFileName="C:\\Windows10Upgrade\\cosquery.dll.badday" (normalized: "c:\\windows10upgrade\\cosquery.dll.badday"), dwFlags=0x1) returned 1 [0037.935] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\cosquery.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0037.935] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0037.935] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0037.935] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0037.935] GetProcessHeap () returned 0x560000 [0037.935] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0037.935] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0037.935] lstrcmpiW (lpString1="DevInv.dll", lpString2=".") returned 1 [0037.935] lstrcmpiW (lpString1="DevInv.dll", lpString2="..") returned 1 [0037.935] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DevInv.dll" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll") returned="C:\\Windows10Upgrade\\DevInv.dll" [0037.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DevInv.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.935] GetProcessHeap () returned 0x560000 [0037.935] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0037.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DevInv.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DevInv.dll", lpUsedDefaultChar=0x0) returned 11 [0037.935] lstrlenA (lpString="DevInv.dll") returned 10 [0037.935] lstrlenA (lpString=".badday") returned 7 [0037.935] lstrlenA (lpString=".badday") returned 7 [0037.935] lstrlenA (lpString="DevInv.dll") returned 10 [0037.935] lstrcmpiA (lpString1="Inv.dll", lpString2=".badday") returned 1 [0037.935] lstrcmpiW (lpString1="DevInv.dll", lpString2="how_to_back_files.html") returned -1 [0037.935] lstrcmpiW (lpString1="DevInv.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0037.935] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0037.935] lstrcmpiW (lpString1="DevInv.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0037.935] GetProcessHeap () returned 0x560000 [0037.935] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0037.935] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0037.936] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=329928) returned 1 [0037.936] GetProcessHeap () returned 0x560000 [0037.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0037.936] GetProcessHeap () returned 0x560000 [0037.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0037.936] lstrlenW (lpString="C:\\Windows10Upgrade\\DevInv.dll") returned 30 [0037.936] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.936] GetProcessHeap () returned 0x560000 [0037.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0037.936] GetProcessHeap () returned 0x560000 [0037.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58b298 [0037.936] lstrlenA (lpString="rsa_encrypt") returned 11 [0037.936] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0037.937] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0037.937] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0037.937] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0037.937] lstrlenA (lpString="010001") returned 6 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ed8 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ff8 [0037.937] GetProcessHeap () returned 0x560000 [0037.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58aff8 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585358 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58aec0 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5851a8 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aec0 | out: hHeap=0x560000) returned 1 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a708 [0037.938] GetProcessHeap () returned 0x560000 [0037.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a8 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0037.939] GetProcessHeap () returned 0x560000 [0037.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.940] GetProcessHeap () returned 0x560000 [0037.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.940] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0037.941] GetProcessHeap () returned 0x560000 [0037.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0037.942] GetProcessHeap () returned 0x560000 [0037.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a708 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aff8 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ff8 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ed8 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0037.943] GetProcessHeap () returned 0x560000 [0037.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0037.943] WriteFile (in: hFile=0x230, lpBuffer=0x58b298*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b298*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0037.953] GetProcessHeap () returned 0x560000 [0037.953] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b298, Size=0x30) returned 0x58b298 [0037.953] GetProcessHeap () returned 0x560000 [0037.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0037.953] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.953] GetProcessHeap () returned 0x560000 [0037.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x508d0) returned 0x58b2d0 [0037.957] ReadFile (in: hFile=0x230, lpBuffer=0x58b2d0, nNumberOfBytesToRead=0x508d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58b2d0*, lpNumberOfBytesRead=0x24ad7e8*=0x508d0, lpOverlapped=0x0) returned 1 [0037.962] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0037.962] WriteFile (in: hFile=0x230, lpBuffer=0x58b2d0*, nNumberOfBytesToWrite=0x508d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58b2d0*, lpNumberOfBytesWritten=0x24ad7e4*=0x508d0, lpOverlapped=0x0) returned 1 [0037.990] GetProcessHeap () returned 0x560000 [0037.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b2d0 | out: hHeap=0x560000) returned 1 [0037.992] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0037.993] WriteFile (in: hFile=0x230, lpBuffer=0x58b298*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b298*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0037.995] CloseHandle (hObject=0x230) returned 1 [0038.001] GetProcessHeap () returned 0x560000 [0038.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0038.001] GetProcessHeap () returned 0x560000 [0038.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.001] GetProcessHeap () returned 0x560000 [0038.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.001] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\DevInv.dll" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll") returned="C:\\Windows10Upgrade\\DevInv.dll" [0038.001] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DevInv.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll.badday") returned="C:\\Windows10Upgrade\\DevInv.dll.badday" [0038.001] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), lpNewFileName="C:\\Windows10Upgrade\\DevInv.dll.badday" (normalized: "c:\\windows10upgrade\\devinv.dll.badday"), dwFlags=0x1) returned 1 [0038.002] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DevInv.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.002] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.002] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.002] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.002] GetProcessHeap () returned 0x560000 [0038.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.002] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0038.002] lstrcmpiW (lpString1="dll1", lpString2=".") returned 1 [0038.002] lstrcmpiW (lpString1="dll1", lpString2="..") returned 1 [0038.002] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="dll1" | out: lpString1="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0038.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0038.002] GetProcessHeap () returned 0x560000 [0038.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a068 [0038.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll1", cchWideChar=-1, lpMultiByteStr=0x58a068, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dll1", lpUsedDefaultChar=0x0) returned 5 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0038.002] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0038.003] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0038.003] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0038.004] GetProcessHeap () returned 0x560000 [0038.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a118 [0038.004] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\") returned 25 [0038.004] GetProcessHeap () returned 0x560000 [0038.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579708 [0038.004] lstrcpyW (in: lpString1=0x579708, lpString2="C:\\Windows10Upgrade\\dll1\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0038.004] GetProcessHeap () returned 0x560000 [0038.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.004] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0038.004] lstrcmpiW (lpString1="dll2", lpString2=".") returned 1 [0038.004] lstrcmpiW (lpString1="dll2", lpString2="..") returned 1 [0038.004] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="dll2" | out: lpString1="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0038.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0038.004] GetProcessHeap () returned 0x560000 [0038.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a068 [0038.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll2", cchWideChar=-1, lpMultiByteStr=0x58a068, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dll2", lpUsedDefaultChar=0x0) returned 5 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0038.004] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0038.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0038.005] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0038.005] GetProcessHeap () returned 0x560000 [0038.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a088 [0038.005] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\") returned 25 [0038.005] GetProcessHeap () returned 0x560000 [0038.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579308 [0038.006] lstrcpyW (in: lpString1=0x579308, lpString2="C:\\Windows10Upgrade\\dll2\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0038.006] GetProcessHeap () returned 0x560000 [0038.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.006] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0038.006] lstrcmpiW (lpString1="downloader.dll", lpString2=".") returned 1 [0038.006] lstrcmpiW (lpString1="downloader.dll", lpString2="..") returned 1 [0038.006] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="downloader.dll" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll") returned="C:\\Windows10Upgrade\\downloader.dll" [0038.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="downloader.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.006] GetProcessHeap () returned 0x560000 [0038.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0038.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="downloader.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="downloader.dll", lpUsedDefaultChar=0x0) returned 15 [0038.006] lstrlenA (lpString="downloader.dll") returned 14 [0038.006] lstrlenA (lpString=".badday") returned 7 [0038.006] lstrlenA (lpString=".badday") returned 7 [0038.006] lstrlenA (lpString="downloader.dll") returned 14 [0038.006] lstrcmpiA (lpString1="der.dll", lpString2=".badday") returned 1 [0038.006] lstrcmpiW (lpString1="downloader.dll", lpString2="how_to_back_files.html") returned -1 [0038.006] lstrcmpiW (lpString1="downloader.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.006] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.006] lstrcmpiW (lpString1="downloader.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.006] GetProcessHeap () returned 0x560000 [0038.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0038.006] CreateFileW (lpFileName="C:\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.008] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=206536) returned 1 [0038.008] GetProcessHeap () returned 0x560000 [0038.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.008] GetProcessHeap () returned 0x560000 [0038.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.008] lstrlenW (lpString="C:\\Windows10Upgrade\\downloader.dll") returned 34 [0038.008] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.008] GetProcessHeap () returned 0x560000 [0038.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.008] GetProcessHeap () returned 0x560000 [0038.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58b2d0 [0038.010] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.010] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.010] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.010] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.010] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.010] GetProcessHeap () returned 0x560000 [0038.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.010] lstrlenA (lpString="010001") returned 6 [0038.010] GetProcessHeap () returned 0x560000 [0038.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0038.010] GetProcessHeap () returned 0x560000 [0038.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.010] GetProcessHeap () returned 0x560000 [0038.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585118 [0038.010] GetProcessHeap () returned 0x560000 [0038.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5845d8 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b070 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584668 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584668 | out: hHeap=0x560000) returned 1 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58af98 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585358 [0038.011] GetProcessHeap () returned 0x560000 [0038.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58af98 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a708 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.012] GetProcessHeap () returned 0x560000 [0038.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.013] GetProcessHeap () returned 0x560000 [0038.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.014] GetProcessHeap () returned 0x560000 [0038.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.014] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.015] GetProcessHeap () returned 0x560000 [0038.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a708 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b070 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5845d8 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585118 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.016] GetProcessHeap () returned 0x560000 [0038.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.016] WriteFile (in: hFile=0x230, lpBuffer=0x58b2d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b2d0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0038.054] GetProcessHeap () returned 0x560000 [0038.054] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b2d0, Size=0x30) returned 0x58b2d0 [0038.054] GetProcessHeap () returned 0x560000 [0038.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.054] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.054] GetProcessHeap () returned 0x560000 [0038.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x326c8) returned 0x58b308 [0038.057] ReadFile (in: hFile=0x230, lpBuffer=0x58b308, nNumberOfBytesToRead=0x326c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58b308*, lpNumberOfBytesRead=0x24ad7e8*=0x326c8, lpOverlapped=0x0) returned 1 [0038.061] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.061] WriteFile (in: hFile=0x230, lpBuffer=0x58b308*, nNumberOfBytesToWrite=0x326c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58b308*, lpNumberOfBytesWritten=0x24ad7e4*=0x326c8, lpOverlapped=0x0) returned 1 [0038.107] GetProcessHeap () returned 0x560000 [0038.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b308 | out: hHeap=0x560000) returned 1 [0038.107] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.107] WriteFile (in: hFile=0x230, lpBuffer=0x58b2d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b2d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.111] CloseHandle (hObject=0x230) returned 1 [0038.115] GetProcessHeap () returned 0x560000 [0038.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0038.115] GetProcessHeap () returned 0x560000 [0038.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.115] GetProcessHeap () returned 0x560000 [0038.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.115] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\downloader.dll" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll") returned="C:\\Windows10Upgrade\\downloader.dll" [0038.115] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\downloader.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll.badday") returned="C:\\Windows10Upgrade\\downloader.dll.badday" [0038.115] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), lpNewFileName="C:\\Windows10Upgrade\\downloader.dll.badday" (normalized: "c:\\windows10upgrade\\downloader.dll.badday"), dwFlags=0x1) returned 1 [0038.116] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\downloader.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.116] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.116] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.116] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.116] GetProcessHeap () returned 0x560000 [0038.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.116] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0038.116] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0038.116] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0038.116] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DW20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0038.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.116] GetProcessHeap () returned 0x560000 [0038.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0038.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 9 [0038.116] lstrlenA (lpString="DW20.EXE") returned 8 [0038.116] lstrlenA (lpString=".badday") returned 7 [0038.116] lstrlenA (lpString=".badday") returned 7 [0038.116] lstrlenA (lpString="DW20.EXE") returned 8 [0038.116] lstrcmpiA (lpString1="W20.EXE", lpString2=".badday") returned 1 [0038.116] lstrcmpiW (lpString1="DW20.EXE", lpString2="how_to_back_files.html") returned -1 [0038.117] lstrcmpiW (lpString1="DW20.EXE", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.117] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.117] lstrcmpiW (lpString1="DW20.EXE", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.117] GetProcessHeap () returned 0x560000 [0038.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d328 [0038.117] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.117] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=643784) returned 1 [0038.117] GetProcessHeap () returned 0x560000 [0038.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.117] GetProcessHeap () returned 0x560000 [0038.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.117] lstrlenW (lpString="C:\\Windows10Upgrade\\DW20.EXE") returned 28 [0038.117] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.117] GetProcessHeap () returned 0x560000 [0038.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.117] GetProcessHeap () returned 0x560000 [0038.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58ae90 [0038.117] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.117] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.118] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.118] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.118] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.118] lstrlenA (lpString="010001") returned 6 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5849c8 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a58 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0038.118] GetProcessHeap () returned 0x560000 [0038.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0038.118] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5860a0 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585238 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585238 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x585f80 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584b78 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585f80 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a708 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.119] GetProcessHeap () returned 0x560000 [0038.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.119] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.120] GetProcessHeap () returned 0x560000 [0038.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.121] GetProcessHeap () returned 0x560000 [0038.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.122] GetProcessHeap () returned 0x560000 [0038.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a708 | out: hHeap=0x560000) returned 1 [0038.123] GetProcessHeap () returned 0x560000 [0038.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5860a0 | out: hHeap=0x560000) returned 1 [0038.124] GetProcessHeap () returned 0x560000 [0038.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a58 | out: hHeap=0x560000) returned 1 [0038.124] GetProcessHeap () returned 0x560000 [0038.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0038.124] GetProcessHeap () returned 0x560000 [0038.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0038.124] GetProcessHeap () returned 0x560000 [0038.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0038.124] GetProcessHeap () returned 0x560000 [0038.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.124] GetProcessHeap () returned 0x560000 [0038.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.124] WriteFile (in: hFile=0x230, lpBuffer=0x58ae90*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.133] GetProcessHeap () returned 0x560000 [0038.133] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58ae90, Size=0x30) returned 0x58ae90 [0038.133] GetProcessHeap () returned 0x560000 [0038.133] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.133] GetProcessHeap () returned 0x560000 [0038.134] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9d2d0) returned 0x24bc020 [0038.144] ReadFile (in: hFile=0x230, lpBuffer=0x24bc020, nNumberOfBytesToRead=0x9d2d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24bc020*, lpNumberOfBytesRead=0x24ad7e8*=0x9d2d0, lpOverlapped=0x0) returned 1 [0038.155] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.155] WriteFile (in: hFile=0x230, lpBuffer=0x24bc020*, nNumberOfBytesToWrite=0x9d2d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24bc020*, lpNumberOfBytesWritten=0x24ad7e4*=0x9d2d0, lpOverlapped=0x0) returned 1 [0038.190] GetProcessHeap () returned 0x560000 [0038.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24bc020 | out: hHeap=0x560000) returned 1 [0038.193] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.193] WriteFile (in: hFile=0x230, lpBuffer=0x58ae90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ae90*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.196] CloseHandle (hObject=0x230) returned 1 [0038.211] GetProcessHeap () returned 0x560000 [0038.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0038.211] GetProcessHeap () returned 0x560000 [0038.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.211] GetProcessHeap () returned 0x560000 [0038.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.211] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\DW20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0038.211] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DW20.EXE", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE.badday") returned="C:\\Windows10Upgrade\\DW20.EXE.badday" [0038.211] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DW20.EXE.badday" (normalized: "c:\\windows10upgrade\\dw20.exe.badday"), dwFlags=0x1) returned 1 [0038.212] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DW20.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.212] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.212] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.212] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.212] GetProcessHeap () returned 0x560000 [0038.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.212] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0038.212] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2=".") returned 1 [0038.212] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="..") returned 1 [0038.212] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DWDCW20.DLL" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL") returned="C:\\Windows10Upgrade\\DWDCW20.DLL" [0038.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWDCW20.DLL", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.212] GetProcessHeap () returned 0x560000 [0038.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0038.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWDCW20.DLL", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWDCW20.DLL", lpUsedDefaultChar=0x0) returned 12 [0038.212] lstrlenA (lpString="DWDCW20.DLL") returned 11 [0038.212] lstrlenA (lpString=".badday") returned 7 [0038.212] lstrlenA (lpString=".badday") returned 7 [0038.213] lstrlenA (lpString="DWDCW20.DLL") returned 11 [0038.213] lstrcmpiA (lpString1="W20.DLL", lpString2=".badday") returned 1 [0038.213] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="how_to_back_files.html") returned -1 [0038.213] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.213] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.213] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.213] GetProcessHeap () returned 0x560000 [0038.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0038.213] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.214] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=49864) returned 1 [0038.214] GetProcessHeap () returned 0x560000 [0038.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.214] GetProcessHeap () returned 0x560000 [0038.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.214] lstrlenW (lpString="C:\\Windows10Upgrade\\DWDCW20.DLL") returned 31 [0038.214] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.214] GetProcessHeap () returned 0x560000 [0038.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.214] GetProcessHeap () returned 0x560000 [0038.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58aec8 [0038.214] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.214] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.215] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.215] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.215] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.215] GetProcessHeap () returned 0x560000 [0038.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.215] lstrlenA (lpString="010001") returned 6 [0038.215] GetProcessHeap () returned 0x560000 [0038.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0038.215] GetProcessHeap () returned 0x560000 [0038.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.215] GetProcessHeap () returned 0x560000 [0038.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585088 [0038.215] GetProcessHeap () returned 0x560000 [0038.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.215] GetProcessHeap () returned 0x560000 [0038.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585238 [0038.215] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5861a8 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ff8 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ff8 | out: hHeap=0x560000) returned 1 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5861c0 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.216] GetProcessHeap () returned 0x560000 [0038.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d28 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5861c0 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a708 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d28 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.217] GetProcessHeap () returned 0x560000 [0038.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.217] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.218] GetProcessHeap () returned 0x560000 [0038.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.218] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.219] GetProcessHeap () returned 0x560000 [0038.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.219] GetProcessHeap () returned 0x560000 [0038.220] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.220] GetProcessHeap () returned 0x560000 [0038.220] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.220] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.221] GetProcessHeap () returned 0x560000 [0038.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.221] GetProcessHeap () returned 0x560000 [0038.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a708 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5861a8 | out: hHeap=0x560000) returned 1 [0038.222] GetProcessHeap () returned 0x560000 [0038.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585238 | out: hHeap=0x560000) returned 1 [0038.223] GetProcessHeap () returned 0x560000 [0038.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0038.223] GetProcessHeap () returned 0x560000 [0038.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0038.223] GetProcessHeap () returned 0x560000 [0038.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0038.223] GetProcessHeap () returned 0x560000 [0038.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.223] GetProcessHeap () returned 0x560000 [0038.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.223] WriteFile (in: hFile=0x230, lpBuffer=0x58aec8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aec8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.231] GetProcessHeap () returned 0x560000 [0038.231] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58aec8, Size=0x30) returned 0x58aec8 [0038.231] GetProcessHeap () returned 0x560000 [0038.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.232] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.232] GetProcessHeap () returned 0x560000 [0038.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc2d0) returned 0x58bb10 [0038.232] ReadFile (in: hFile=0x230, lpBuffer=0x58bb10, nNumberOfBytesToRead=0xc2d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesRead=0x24ad7e8*=0xc2d0, lpOverlapped=0x0) returned 1 [0038.234] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.234] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0xc2d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad7e4*=0xc2d0, lpOverlapped=0x0) returned 1 [0038.240] GetProcessHeap () returned 0x560000 [0038.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb10 | out: hHeap=0x560000) returned 1 [0038.241] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.241] WriteFile (in: hFile=0x230, lpBuffer=0x58aec8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aec8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.242] CloseHandle (hObject=0x230) returned 1 [0038.244] GetProcessHeap () returned 0x560000 [0038.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0038.244] GetProcessHeap () returned 0x560000 [0038.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.244] GetProcessHeap () returned 0x560000 [0038.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.244] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\DWDCW20.DLL" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL") returned="C:\\Windows10Upgrade\\DWDCW20.DLL" [0038.245] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL.badday") returned="C:\\Windows10Upgrade\\DWDCW20.DLL.badday" [0038.245] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), lpNewFileName="C:\\Windows10Upgrade\\DWDCW20.DLL.badday" (normalized: "c:\\windows10upgrade\\dwdcw20.dll.badday"), dwFlags=0x1) returned 1 [0038.246] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DWDCW20.DLL" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.246] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.246] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.246] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.246] GetProcessHeap () returned 0x560000 [0038.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.246] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0038.246] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".") returned 1 [0038.246] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="..") returned 1 [0038.246] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DWTRIG20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0038.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.246] GetProcessHeap () returned 0x560000 [0038.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0038.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWTRIG20.EXE", lpUsedDefaultChar=0x0) returned 13 [0038.246] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0038.246] lstrlenA (lpString=".badday") returned 7 [0038.246] lstrlenA (lpString=".badday") returned 7 [0038.246] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0038.246] lstrcmpiA (lpString1="G20.EXE", lpString2=".badday") returned 1 [0038.246] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="how_to_back_files.html") returned -1 [0038.246] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.246] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.246] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.246] GetProcessHeap () returned 0x560000 [0038.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0038.247] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.247] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=45768) returned 1 [0038.247] GetProcessHeap () returned 0x560000 [0038.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.247] GetProcessHeap () returned 0x560000 [0038.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.247] lstrlenW (lpString="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned 32 [0038.247] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.247] GetProcessHeap () returned 0x560000 [0038.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.247] GetProcessHeap () returned 0x560000 [0038.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58af00 [0038.247] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.247] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.248] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.248] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.248] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.248] lstrlenA (lpString="010001") returned 6 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b78 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ed8 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0038.248] GetProcessHeap () returned 0x560000 [0038.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.248] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x585fb0 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f68 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f68 | out: hHeap=0x560000) returned 1 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x586088 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.249] GetProcessHeap () returned 0x560000 [0038.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.249] GetProcessHeap () returned 0x560000 [0038.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ff8 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586088 | out: hHeap=0x560000) returned 1 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58a708 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ff8 | out: hHeap=0x560000) returned 1 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.250] GetProcessHeap () returned 0x560000 [0038.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.250] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.251] GetProcessHeap () returned 0x560000 [0038.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.251] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.252] GetProcessHeap () returned 0x560000 [0038.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.253] GetProcessHeap () returned 0x560000 [0038.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a708 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585fb0 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ed8 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0038.254] GetProcessHeap () returned 0x560000 [0038.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.255] GetProcessHeap () returned 0x560000 [0038.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.255] WriteFile (in: hFile=0x230, lpBuffer=0x58af00*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58af00*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0038.261] GetProcessHeap () returned 0x560000 [0038.261] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58af00, Size=0x30) returned 0x58af00 [0038.261] GetProcessHeap () returned 0x560000 [0038.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.261] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.261] GetProcessHeap () returned 0x560000 [0038.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb2c8) returned 0x58bb10 [0038.263] ReadFile (in: hFile=0x230, lpBuffer=0x58bb10, nNumberOfBytesToRead=0xb2c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesRead=0x24ad7e8*=0xb2c8, lpOverlapped=0x0) returned 1 [0038.264] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.264] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0xb2c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad7e4*=0xb2c8, lpOverlapped=0x0) returned 1 [0038.272] GetProcessHeap () returned 0x560000 [0038.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb10 | out: hHeap=0x560000) returned 1 [0038.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.272] WriteFile (in: hFile=0x230, lpBuffer=0x58af00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58af00*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.273] CloseHandle (hObject=0x230) returned 1 [0038.274] GetProcessHeap () returned 0x560000 [0038.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0038.274] GetProcessHeap () returned 0x560000 [0038.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.274] GetProcessHeap () returned 0x560000 [0038.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.275] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0038.275] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE.badday") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE.badday" [0038.275] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.badday" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.badday"), dwFlags=0x1) returned 1 [0038.275] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.275] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.275] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.275] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.275] GetProcessHeap () returned 0x560000 [0038.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.275] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0038.275] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2=".") returned 1 [0038.275] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="..") returned 1 [0038.275] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" [0038.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EnableWiFiTracing.cmd", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0038.275] GetProcessHeap () returned 0x560000 [0038.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x5768d8 [0038.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EnableWiFiTracing.cmd", cchWideChar=-1, lpMultiByteStr=0x5768d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EnableWiFiTracing.cmd", lpUsedDefaultChar=0x0) returned 22 [0038.276] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0038.276] lstrlenA (lpString=".badday") returned 7 [0038.276] lstrlenA (lpString=".badday") returned 7 [0038.276] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0038.276] lstrcmpiA (lpString1="ing.cmd", lpString2=".badday") returned 1 [0038.276] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="how_to_back_files.html") returned -1 [0038.276] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.276] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.276] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.276] GetProcessHeap () returned 0x560000 [0038.276] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0038.276] CreateFileW (lpFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.276] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=9810) returned 1 [0038.276] GetProcessHeap () returned 0x560000 [0038.276] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.276] GetProcessHeap () returned 0x560000 [0038.276] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.276] lstrlenW (lpString="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned 41 [0038.276] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.276] GetProcessHeap () returned 0x560000 [0038.276] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.276] GetProcessHeap () returned 0x560000 [0038.277] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x585dd0 [0038.277] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.277] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.277] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.277] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.277] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.277] GetProcessHeap () returned 0x560000 [0038.277] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.277] lstrlenA (lpString="010001") returned 6 [0038.277] GetProcessHeap () returned 0x560000 [0038.277] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0038.277] GetProcessHeap () returned 0x560000 [0038.277] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.277] GetProcessHeap () returned 0x560000 [0038.277] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585118 [0038.277] GetProcessHeap () returned 0x560000 [0038.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.277] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b78 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585358 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58aa38 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584c98 [0038.278] GetProcessHeap () returned 0x560000 [0038.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aa38 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58af38 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.279] GetProcessHeap () returned 0x560000 [0038.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.280] GetProcessHeap () returned 0x560000 [0038.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.280] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.281] GetProcessHeap () returned 0x560000 [0038.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.282] GetProcessHeap () returned 0x560000 [0038.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58af38 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b78 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585118 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.283] GetProcessHeap () returned 0x560000 [0038.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.283] WriteFile (in: hFile=0x230, lpBuffer=0x585dd0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x585dd0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0038.290] GetProcessHeap () returned 0x560000 [0038.290] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x585dd0, Size=0x30) returned 0x585dd0 [0038.290] GetProcessHeap () returned 0x560000 [0038.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.290] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.290] GetProcessHeap () returned 0x560000 [0038.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2652) returned 0x58bb10 [0038.290] ReadFile (in: hFile=0x230, lpBuffer=0x58bb10, nNumberOfBytesToRead=0x2652, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesRead=0x24ad7e8*=0x2652, lpOverlapped=0x0) returned 1 [0038.290] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.291] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0x2652, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad7e4*=0x2652, lpOverlapped=0x0) returned 1 [0038.291] GetProcessHeap () returned 0x560000 [0038.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb10 | out: hHeap=0x560000) returned 1 [0038.291] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.292] WriteFile (in: hFile=0x230, lpBuffer=0x585dd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x585dd0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.292] CloseHandle (hObject=0x230) returned 1 [0038.294] GetProcessHeap () returned 0x560000 [0038.294] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0038.294] GetProcessHeap () returned 0x560000 [0038.294] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.294] GetProcessHeap () returned 0x560000 [0038.294] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.294] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" [0038.294] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.badday") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.badday" [0038.294] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.badday" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.badday"), dwFlags=0x1) returned 1 [0038.294] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.294] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.294] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.294] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.294] GetProcessHeap () returned 0x560000 [0038.294] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5768d8 | out: hHeap=0x560000) returned 1 [0038.295] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0038.295] lstrcmpiW (lpString1="ESDHelper.dll", lpString2=".") returned 1 [0038.295] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="..") returned 1 [0038.295] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="ESDHelper.dll" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll") returned="C:\\Windows10Upgrade\\ESDHelper.dll" [0038.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESDHelper.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0038.295] GetProcessHeap () returned 0x560000 [0038.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0038.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESDHelper.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESDHelper.dll", lpUsedDefaultChar=0x0) returned 14 [0038.295] lstrlenA (lpString="ESDHelper.dll") returned 13 [0038.295] lstrlenA (lpString=".badday") returned 7 [0038.295] lstrlenA (lpString=".badday") returned 7 [0038.295] lstrlenA (lpString="ESDHelper.dll") returned 13 [0038.295] lstrcmpiA (lpString1="per.dll", lpString2=".badday") returned 1 [0038.295] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="how_to_back_files.html") returned -1 [0038.295] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.295] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.295] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.295] GetProcessHeap () returned 0x560000 [0038.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0038.295] CreateFileW (lpFileName="C:\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.295] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=68808) returned 1 [0038.295] GetProcessHeap () returned 0x560000 [0038.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.295] GetProcessHeap () returned 0x560000 [0038.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.296] lstrlenW (lpString="C:\\Windows10Upgrade\\ESDHelper.dll") returned 33 [0038.296] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.296] GetProcessHeap () returned 0x560000 [0038.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.296] GetProcessHeap () returned 0x560000 [0038.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x585e08 [0038.296] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.296] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.297] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.297] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.297] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.297] lstrlenA (lpString="010001") returned 6 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584938 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e48 [0038.297] GetProcessHeap () returned 0x560000 [0038.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x570898 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x570678 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5703a0 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58a888 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ed8 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584298 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ed8 | out: hHeap=0x560000) returned 1 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58a840 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585358 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a840 | out: hHeap=0x560000) returned 1 [0038.298] GetProcessHeap () returned 0x560000 [0038.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58af38 [0038.298] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.299] GetProcessHeap () returned 0x560000 [0038.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.300] GetProcessHeap () returned 0x560000 [0038.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.301] GetProcessHeap () returned 0x560000 [0038.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.302] GetProcessHeap () returned 0x560000 [0038.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58af38 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a888 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e48 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584938 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570678 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.303] GetProcessHeap () returned 0x560000 [0038.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.303] WriteFile (in: hFile=0x230, lpBuffer=0x585e08*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x585e08*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.312] GetProcessHeap () returned 0x560000 [0038.312] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x585e08, Size=0x30) returned 0x585e08 [0038.312] GetProcessHeap () returned 0x560000 [0038.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.312] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.312] GetProcessHeap () returned 0x560000 [0038.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10cd0) returned 0x58bb10 [0038.313] ReadFile (in: hFile=0x230, lpBuffer=0x58bb10, nNumberOfBytesToRead=0x10cd0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesRead=0x24ad7e8*=0x10cd0, lpOverlapped=0x0) returned 1 [0038.314] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.314] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0x10cd0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad7e4*=0x10cd0, lpOverlapped=0x0) returned 1 [0038.333] GetProcessHeap () returned 0x560000 [0038.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb10 | out: hHeap=0x560000) returned 1 [0038.333] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.333] WriteFile (in: hFile=0x230, lpBuffer=0x585e08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x585e08*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.334] CloseHandle (hObject=0x230) returned 1 [0038.336] GetProcessHeap () returned 0x560000 [0038.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0038.336] GetProcessHeap () returned 0x560000 [0038.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.336] GetProcessHeap () returned 0x560000 [0038.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.336] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\ESDHelper.dll" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll") returned="C:\\Windows10Upgrade\\ESDHelper.dll" [0038.336] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll.badday") returned="C:\\Windows10Upgrade\\ESDHelper.dll.badday" [0038.336] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), lpNewFileName="C:\\Windows10Upgrade\\ESDHelper.dll.badday" (normalized: "c:\\windows10upgrade\\esdhelper.dll.badday"), dwFlags=0x1) returned 1 [0038.340] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\ESDHelper.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.340] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.340] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.340] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.340] GetProcessHeap () returned 0x560000 [0038.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.340] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0038.340] lstrcmpiW (lpString1="esdstub.dll", lpString2=".") returned 1 [0038.340] lstrcmpiW (lpString1="esdstub.dll", lpString2="..") returned 1 [0038.340] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="esdstub.dll" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll") returned="C:\\Windows10Upgrade\\esdstub.dll" [0038.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esdstub.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.340] GetProcessHeap () returned 0x560000 [0038.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0038.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esdstub.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esdstub.dll", lpUsedDefaultChar=0x0) returned 12 [0038.340] lstrlenA (lpString="esdstub.dll") returned 11 [0038.340] lstrlenA (lpString=".badday") returned 7 [0038.340] lstrlenA (lpString=".badday") returned 7 [0038.341] lstrlenA (lpString="esdstub.dll") returned 11 [0038.341] lstrcmpiA (lpString1="tub.dll", lpString2=".badday") returned 1 [0038.341] lstrcmpiW (lpString1="esdstub.dll", lpString2="how_to_back_files.html") returned -1 [0038.341] lstrcmpiW (lpString1="esdstub.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.341] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.341] lstrcmpiW (lpString1="esdstub.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.341] GetProcessHeap () returned 0x560000 [0038.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0038.341] CreateFileW (lpFileName="C:\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.341] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=40648) returned 1 [0038.342] GetProcessHeap () returned 0x560000 [0038.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.342] GetProcessHeap () returned 0x560000 [0038.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.342] lstrlenW (lpString="C:\\Windows10Upgrade\\esdstub.dll") returned 31 [0038.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.342] GetProcessHeap () returned 0x560000 [0038.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.342] GetProcessHeap () returned 0x560000 [0038.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x585e40 [0038.342] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.342] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.342] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.342] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.342] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.343] lstrlenA (lpString="010001") returned 6 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5845d8 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846f8 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.343] GetProcessHeap () returned 0x560000 [0038.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0038.343] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58aac8 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585358 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585358 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58aa98 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584ff8 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aa98 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ff8 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.344] GetProcessHeap () returned 0x560000 [0038.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.344] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.345] GetProcessHeap () returned 0x560000 [0038.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.346] GetProcessHeap () returned 0x560000 [0038.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.347] GetProcessHeap () returned 0x560000 [0038.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.347] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.348] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58aac8 | out: hHeap=0x560000) returned 1 [0038.349] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846f8 | out: hHeap=0x560000) returned 1 [0038.349] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0038.349] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5845d8 | out: hHeap=0x560000) returned 1 [0038.349] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0038.349] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.349] GetProcessHeap () returned 0x560000 [0038.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.349] WriteFile (in: hFile=0x230, lpBuffer=0x585e40*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x585e40*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.372] GetProcessHeap () returned 0x560000 [0038.372] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x585e40, Size=0x30) returned 0x585e40 [0038.372] GetProcessHeap () returned 0x560000 [0038.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.372] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.372] GetProcessHeap () returned 0x560000 [0038.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9ed0) returned 0x58bb10 [0038.372] ReadFile (in: hFile=0x230, lpBuffer=0x58bb10, nNumberOfBytesToRead=0x9ed0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesRead=0x24ad7e8*=0x9ed0, lpOverlapped=0x0) returned 1 [0038.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.373] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0x9ed0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad7e4*=0x9ed0, lpOverlapped=0x0) returned 1 [0038.379] GetProcessHeap () returned 0x560000 [0038.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb10 | out: hHeap=0x560000) returned 1 [0038.381] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.381] WriteFile (in: hFile=0x230, lpBuffer=0x585e40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x585e40*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.382] CloseHandle (hObject=0x230) returned 1 [0038.384] GetProcessHeap () returned 0x560000 [0038.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0038.384] GetProcessHeap () returned 0x560000 [0038.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.384] GetProcessHeap () returned 0x560000 [0038.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.384] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\esdstub.dll" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll") returned="C:\\Windows10Upgrade\\esdstub.dll" [0038.384] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\esdstub.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll.badday") returned="C:\\Windows10Upgrade\\esdstub.dll.badday" [0038.384] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), lpNewFileName="C:\\Windows10Upgrade\\esdstub.dll.badday" (normalized: "c:\\windows10upgrade\\esdstub.dll.badday"), dwFlags=0x1) returned 1 [0038.384] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\esdstub.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.384] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.385] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.385] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.385] GetProcessHeap () returned 0x560000 [0038.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.385] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0038.385] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2=".") returned 1 [0038.385] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="..") returned 1 [0038.385] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GatherOSState.EXE" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0038.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GatherOSState.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0038.385] GetProcessHeap () returned 0x560000 [0038.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576878 [0038.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GatherOSState.EXE", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GatherOSState.EXE", lpUsedDefaultChar=0x0) returned 18 [0038.385] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0038.385] lstrlenA (lpString=".badday") returned 7 [0038.385] lstrlenA (lpString=".badday") returned 7 [0038.385] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0038.385] lstrcmpiA (lpString1="ate.EXE", lpString2=".badday") returned 1 [0038.385] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="how_to_back_files.html") returned -1 [0038.385] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.385] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.385] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.385] GetProcessHeap () returned 0x560000 [0038.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0038.385] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.386] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=564936) returned 1 [0038.386] GetProcessHeap () returned 0x560000 [0038.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.386] GetProcessHeap () returned 0x560000 [0038.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.386] lstrlenW (lpString="C:\\Windows10Upgrade\\GatherOSState.EXE") returned 37 [0038.386] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.386] GetProcessHeap () returned 0x560000 [0038.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.386] GetProcessHeap () returned 0x560000 [0038.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56e0c0 [0038.386] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.386] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.388] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.388] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.388] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.388] lstrlenA (lpString="010001") returned 6 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584980 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c50 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0038.388] GetProcessHeap () returned 0x560000 [0038.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.388] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584bc0 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e6d8 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584aa0 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e6d8 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.389] GetProcessHeap () returned 0x560000 [0038.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.390] GetProcessHeap () returned 0x560000 [0038.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.391] GetProcessHeap () returned 0x560000 [0038.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.392] GetProcessHeap () returned 0x560000 [0038.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0038.393] GetProcessHeap () returned 0x560000 [0038.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.394] GetProcessHeap () returned 0x560000 [0038.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c50 | out: hHeap=0x560000) returned 1 [0038.394] GetProcessHeap () returned 0x560000 [0038.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.394] GetProcessHeap () returned 0x560000 [0038.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584980 | out: hHeap=0x560000) returned 1 [0038.394] GetProcessHeap () returned 0x560000 [0038.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0038.394] GetProcessHeap () returned 0x560000 [0038.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.394] GetProcessHeap () returned 0x560000 [0038.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.394] WriteFile (in: hFile=0x230, lpBuffer=0x56e0c0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e0c0*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.398] GetProcessHeap () returned 0x560000 [0038.398] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e0c0, Size=0x30) returned 0x56e0c0 [0038.398] GetProcessHeap () returned 0x560000 [0038.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.398] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.398] GetProcessHeap () returned 0x560000 [0038.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x89ed0) returned 0x24bd020 [0038.408] ReadFile (in: hFile=0x230, lpBuffer=0x24bd020, nNumberOfBytesToRead=0x89ed0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24bd020*, lpNumberOfBytesRead=0x24ad7e8*=0x89ed0, lpOverlapped=0x0) returned 1 [0038.416] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.417] WriteFile (in: hFile=0x230, lpBuffer=0x24bd020*, nNumberOfBytesToWrite=0x89ed0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24bd020*, lpNumberOfBytesWritten=0x24ad7e4*=0x89ed0, lpOverlapped=0x0) returned 1 [0038.443] GetProcessHeap () returned 0x560000 [0038.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24bd020 | out: hHeap=0x560000) returned 1 [0038.445] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.446] WriteFile (in: hFile=0x230, lpBuffer=0x56e0c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e0c0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.446] CloseHandle (hObject=0x230) returned 1 [0038.456] GetProcessHeap () returned 0x560000 [0038.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0038.456] GetProcessHeap () returned 0x560000 [0038.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.456] GetProcessHeap () returned 0x560000 [0038.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.456] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0038.456] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE.badday") returned="C:\\Windows10Upgrade\\GatherOSState.EXE.badday" [0038.456] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), lpNewFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.badday" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.badday"), dwFlags=0x1) returned 1 [0038.456] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.456] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.456] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.456] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.456] GetProcessHeap () returned 0x560000 [0038.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0038.457] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0038.457] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2=".") returned 1 [0038.457] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="..") returned 1 [0038.457] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentDeploy.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" [0038.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentDeploy.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0038.457] GetProcessHeap () returned 0x560000 [0038.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x5769f8 [0038.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentDeploy.dll", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentDeploy.dll", lpUsedDefaultChar=0x0) returned 21 [0038.457] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0038.457] lstrlenA (lpString=".badday") returned 7 [0038.457] lstrlenA (lpString=".badday") returned 7 [0038.457] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0038.457] lstrcmpiA (lpString1="loy.dll", lpString2=".badday") returned 1 [0038.457] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="how_to_back_files.html") returned -1 [0038.457] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.457] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.457] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.457] GetProcessHeap () returned 0x560000 [0038.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0038.457] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.457] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=539848) returned 1 [0038.457] GetProcessHeap () returned 0x560000 [0038.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.458] GetProcessHeap () returned 0x560000 [0038.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.458] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned 40 [0038.458] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.458] GetProcessHeap () returned 0x560000 [0038.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.458] GetProcessHeap () returned 0x560000 [0038.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e858 [0038.458] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.458] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.459] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.459] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.459] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.459] lstrlenA (lpString="010001") returned 6 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584860 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ce0 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.459] GetProcessHeap () returned 0x560000 [0038.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584740 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e7e0 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584bc0 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e7e0 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.460] GetProcessHeap () returned 0x560000 [0038.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.460] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.461] GetProcessHeap () returned 0x560000 [0038.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.461] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.462] GetProcessHeap () returned 0x560000 [0038.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.463] GetProcessHeap () returned 0x560000 [0038.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0038.464] GetProcessHeap () returned 0x560000 [0038.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.465] GetProcessHeap () returned 0x560000 [0038.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ce0 | out: hHeap=0x560000) returned 1 [0038.465] GetProcessHeap () returned 0x560000 [0038.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0038.465] GetProcessHeap () returned 0x560000 [0038.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584860 | out: hHeap=0x560000) returned 1 [0038.465] GetProcessHeap () returned 0x560000 [0038.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0038.465] GetProcessHeap () returned 0x560000 [0038.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.465] GetProcessHeap () returned 0x560000 [0038.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.465] WriteFile (in: hFile=0x230, lpBuffer=0x56e858*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e858*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0038.470] GetProcessHeap () returned 0x560000 [0038.470] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e858, Size=0x30) returned 0x56e858 [0038.470] GetProcessHeap () returned 0x560000 [0038.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.470] GetProcessHeap () returned 0x560000 [0038.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x83cc8) returned 0x24b3020 [0038.479] ReadFile (in: hFile=0x230, lpBuffer=0x24b3020, nNumberOfBytesToRead=0x83cc8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b3020*, lpNumberOfBytesRead=0x24ad7e8*=0x83cc8, lpOverlapped=0x0) returned 1 [0038.488] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.488] WriteFile (in: hFile=0x230, lpBuffer=0x24b3020*, nNumberOfBytesToWrite=0x83cc8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b3020*, lpNumberOfBytesWritten=0x24ad7e4*=0x83cc8, lpOverlapped=0x0) returned 1 [0038.535] GetProcessHeap () returned 0x560000 [0038.535] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b3020 | out: hHeap=0x560000) returned 1 [0038.538] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.538] WriteFile (in: hFile=0x230, lpBuffer=0x56e858*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e858*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.539] CloseHandle (hObject=0x230) returned 1 [0038.548] GetProcessHeap () returned 0x560000 [0038.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0038.548] GetProcessHeap () returned 0x560000 [0038.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.548] GetProcessHeap () returned 0x560000 [0038.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.548] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" [0038.548] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll.badday") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll.badday" [0038.548] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentDeploy.dll.badday" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll.badday"), dwFlags=0x1) returned 1 [0038.549] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.549] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.549] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.549] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.549] GetProcessHeap () returned 0x560000 [0038.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0038.549] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0038.549] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2=".") returned 1 [0038.549] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="..") returned 1 [0038.549] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentOOBE.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" [0038.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentOOBE.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.549] GetProcessHeap () returned 0x560000 [0038.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576838 [0038.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentOOBE.dll", cchWideChar=-1, lpMultiByteStr=0x576838, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentOOBE.dll", lpUsedDefaultChar=0x0) returned 19 [0038.549] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0038.549] lstrlenA (lpString=".badday") returned 7 [0038.549] lstrlenA (lpString=".badday") returned 7 [0038.549] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0038.549] lstrcmpiA (lpString1="OBE.dll", lpString2=".badday") returned 1 [0038.549] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="how_to_back_files.html") returned -1 [0038.549] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.549] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.550] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.550] GetProcessHeap () returned 0x560000 [0038.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0038.550] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.550] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=144072) returned 1 [0038.550] GetProcessHeap () returned 0x560000 [0038.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.550] GetProcessHeap () returned 0x560000 [0038.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.550] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned 38 [0038.550] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.550] GetProcessHeap () returned 0x560000 [0038.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.550] GetProcessHeap () returned 0x560000 [0038.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e890 [0038.550] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.550] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.551] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.551] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.551] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.551] lstrlenA (lpString="010001") returned 6 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a068 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584590 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584620 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0038.551] GetProcessHeap () returned 0x560000 [0038.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5850d0 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0038.552] GetProcessHeap () returned 0x560000 [0038.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850d0 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e768 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5848f0 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e768 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.553] GetProcessHeap () returned 0x560000 [0038.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.554] GetProcessHeap () returned 0x560000 [0038.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.554] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.555] GetProcessHeap () returned 0x560000 [0038.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.555] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.556] GetProcessHeap () returned 0x560000 [0038.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.556] GetProcessHeap () returned 0x560000 [0038.557] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584620 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584590 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.557] GetProcessHeap () returned 0x560000 [0038.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.557] WriteFile (in: hFile=0x230, lpBuffer=0x56e890*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e890*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0038.561] GetProcessHeap () returned 0x560000 [0038.561] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e890, Size=0x30) returned 0x56e890 [0038.561] GetProcessHeap () returned 0x560000 [0038.561] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.561] GetProcessHeap () returned 0x560000 [0038.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x232c8) returned 0x58eb28 [0038.563] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x232c8, lpOverlapped=0x0) returned 1 [0038.572] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.572] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x232c8, lpOverlapped=0x0) returned 1 [0038.608] GetProcessHeap () returned 0x560000 [0038.608] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0038.608] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.608] WriteFile (in: hFile=0x230, lpBuffer=0x56e890*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e890*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.609] CloseHandle (hObject=0x230) returned 1 [0038.612] GetProcessHeap () returned 0x560000 [0038.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0038.612] GetProcessHeap () returned 0x560000 [0038.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.612] GetProcessHeap () returned 0x560000 [0038.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.612] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" [0038.612] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll.badday") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll.badday" [0038.612] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentOOBE.dll.badday" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll.badday"), dwFlags=0x1) returned 1 [0038.613] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.613] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.613] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.613] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.613] GetProcessHeap () returned 0x560000 [0038.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576838 | out: hHeap=0x560000) returned 1 [0038.613] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0038.613] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2=".") returned 1 [0038.613] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="..") returned 1 [0038.613] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentRollback.EXE" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0038.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentRollback.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0038.613] GetProcessHeap () returned 0x560000 [0038.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576ab8 [0038.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentRollback.EXE", cchWideChar=-1, lpMultiByteStr=0x576ab8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentRollback.EXE", lpUsedDefaultChar=0x0) returned 23 [0038.613] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0038.613] lstrlenA (lpString=".badday") returned 7 [0038.613] lstrlenA (lpString=".badday") returned 7 [0038.613] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0038.613] lstrcmpiA (lpString1="ack.EXE", lpString2=".badday") returned 1 [0038.613] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="how_to_back_files.html") returned -1 [0038.613] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.614] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.614] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.614] GetProcessHeap () returned 0x560000 [0038.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0038.614] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.614] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=73416) returned 1 [0038.615] GetProcessHeap () returned 0x560000 [0038.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.615] GetProcessHeap () returned 0x560000 [0038.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.615] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned 42 [0038.615] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.615] GetProcessHeap () returned 0x560000 [0038.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.615] GetProcessHeap () returned 0x560000 [0038.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56e8c8 [0038.615] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.615] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.615] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.615] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.615] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.616] lstrlenA (lpString="010001") returned 6 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.616] GetProcessHeap () returned 0x560000 [0038.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0038.616] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e810 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584aa0 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e810 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.617] GetProcessHeap () returned 0x560000 [0038.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.617] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.618] GetProcessHeap () returned 0x560000 [0038.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.619] GetProcessHeap () returned 0x560000 [0038.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.619] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.620] GetProcessHeap () returned 0x560000 [0038.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.621] GetProcessHeap () returned 0x560000 [0038.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.622] GetProcessHeap () returned 0x560000 [0038.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.622] WriteFile (in: hFile=0x230, lpBuffer=0x56e8c8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e8c8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.632] GetProcessHeap () returned 0x560000 [0038.632] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e8c8, Size=0x30) returned 0x56e8c8 [0038.632] GetProcessHeap () returned 0x560000 [0038.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.632] GetProcessHeap () returned 0x560000 [0038.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11ed0) returned 0x58eb28 [0038.632] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x11ed0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x11ed0, lpOverlapped=0x0) returned 1 [0038.634] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.634] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x11ed0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x11ed0, lpOverlapped=0x0) returned 1 [0038.641] GetProcessHeap () returned 0x560000 [0038.641] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0038.641] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.641] WriteFile (in: hFile=0x230, lpBuffer=0x56e8c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e8c8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.642] CloseHandle (hObject=0x230) returned 1 [0038.644] GetProcessHeap () returned 0x560000 [0038.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0038.644] GetProcessHeap () returned 0x560000 [0038.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.644] GetProcessHeap () returned 0x560000 [0038.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.644] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0038.644] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.badday") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.badday" [0038.644] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.badday" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.badday"), dwFlags=0x1) returned 1 [0038.645] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.645] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.645] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.645] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.645] GetProcessHeap () returned 0x560000 [0038.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576ab8 | out: hHeap=0x560000) returned 1 [0038.645] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0038.645] lstrcmpiW (lpString1="HttpHelper.exe", lpString2=".") returned 1 [0038.645] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="..") returned 1 [0038.645] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HttpHelper.exe" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0038.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HttpHelper.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.645] GetProcessHeap () returned 0x560000 [0038.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0038.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HttpHelper.exe", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HttpHelper.exe", lpUsedDefaultChar=0x0) returned 15 [0038.646] lstrlenA (lpString="HttpHelper.exe") returned 14 [0038.646] lstrlenA (lpString=".badday") returned 7 [0038.646] lstrlenA (lpString=".badday") returned 7 [0038.646] lstrlenA (lpString="HttpHelper.exe") returned 14 [0038.646] lstrcmpiA (lpString1="per.exe", lpString2=".badday") returned 1 [0038.646] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="how_to_back_files.html") returned 1 [0038.646] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.646] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.646] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0038.646] GetProcessHeap () returned 0x560000 [0038.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0038.646] CreateFileW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.647] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=27848) returned 1 [0038.647] GetProcessHeap () returned 0x560000 [0038.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.647] GetProcessHeap () returned 0x560000 [0038.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.647] lstrlenW (lpString="C:\\Windows10Upgrade\\HttpHelper.exe") returned 34 [0038.647] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.647] GetProcessHeap () returned 0x560000 [0038.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.647] GetProcessHeap () returned 0x560000 [0038.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e900 [0038.647] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.647] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.647] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.647] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.647] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.647] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.648] lstrlenA (lpString="010001") returned 6 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584bc0 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584500 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4f8 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5842c0 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0038.648] GetProcessHeap () returned 0x560000 [0038.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e510 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584620 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e510 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584620 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.649] GetProcessHeap () returned 0x560000 [0038.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.650] GetProcessHeap () returned 0x560000 [0038.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.650] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.651] GetProcessHeap () returned 0x560000 [0038.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.651] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.652] GetProcessHeap () returned 0x560000 [0038.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.652] GetProcessHeap () returned 0x560000 [0038.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4f8 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.653] GetProcessHeap () returned 0x560000 [0038.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.653] WriteFile (in: hFile=0x230, lpBuffer=0x56e900*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e900*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0038.686] GetProcessHeap () returned 0x560000 [0038.686] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e900, Size=0x30) returned 0x56e900 [0038.686] GetProcessHeap () returned 0x560000 [0038.686] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.686] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.686] GetProcessHeap () returned 0x560000 [0038.686] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6cc8) returned 0x58eb28 [0038.686] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x6cc8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x6cc8, lpOverlapped=0x0) returned 1 [0038.687] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.687] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x6cc8, lpOverlapped=0x0) returned 1 [0038.692] GetProcessHeap () returned 0x560000 [0038.692] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0038.694] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.694] WriteFile (in: hFile=0x230, lpBuffer=0x56e900*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e900*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.695] CloseHandle (hObject=0x230) returned 1 [0038.696] GetProcessHeap () returned 0x560000 [0038.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0038.696] GetProcessHeap () returned 0x560000 [0038.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.697] GetProcessHeap () returned 0x560000 [0038.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.697] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\HttpHelper.exe" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0038.697] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe.badday") returned="C:\\Windows10Upgrade\\HttpHelper.exe.badday" [0038.697] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), lpNewFileName="C:\\Windows10Upgrade\\HttpHelper.exe.badday" (normalized: "c:\\windows10upgrade\\httphelper.exe.badday"), dwFlags=0x1) returned 1 [0038.697] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\HttpHelper.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.697] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.697] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.697] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.697] GetProcessHeap () returned 0x560000 [0038.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.697] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0038.697] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2=".") returned 1 [0038.697] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="..") returned 1 [0038.697] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd" [0038.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PostOOBEScript.cmd", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.698] GetProcessHeap () returned 0x560000 [0038.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576a98 [0038.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PostOOBEScript.cmd", cchWideChar=-1, lpMultiByteStr=0x576a98, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PostOOBEScript.cmd", lpUsedDefaultChar=0x0) returned 19 [0038.698] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0038.698] lstrlenA (lpString=".badday") returned 7 [0038.698] lstrlenA (lpString=".badday") returned 7 [0038.698] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0038.698] lstrcmpiA (lpString1="ipt.cmd", lpString2=".badday") returned 1 [0038.698] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="how_to_back_files.html") returned 1 [0038.698] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.698] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.698] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0038.698] GetProcessHeap () returned 0x560000 [0038.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0038.698] CreateFileW (lpFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.699] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=577) returned 1 [0038.699] GetProcessHeap () returned 0x560000 [0038.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.699] GetProcessHeap () returned 0x560000 [0038.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.699] lstrlenW (lpString="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned 38 [0038.699] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.699] GetProcessHeap () returned 0x560000 [0038.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.699] GetProcessHeap () returned 0x560000 [0038.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x56e938 [0038.699] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.699] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.700] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.700] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.700] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.700] lstrlenA (lpString="010001") returned 6 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584500 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.700] GetProcessHeap () returned 0x560000 [0038.700] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584860 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584860 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e648 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584bc0 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e648 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.701] GetProcessHeap () returned 0x560000 [0038.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.701] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.702] GetProcessHeap () returned 0x560000 [0038.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.703] GetProcessHeap () returned 0x560000 [0038.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.703] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.704] GetProcessHeap () returned 0x560000 [0038.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0038.705] GetProcessHeap () returned 0x560000 [0038.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.706] GetProcessHeap () returned 0x560000 [0038.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0038.706] GetProcessHeap () returned 0x560000 [0038.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0038.706] GetProcessHeap () returned 0x560000 [0038.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0038.706] GetProcessHeap () returned 0x560000 [0038.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0038.706] GetProcessHeap () returned 0x560000 [0038.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.706] GetProcessHeap () returned 0x560000 [0038.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.706] WriteFile (in: hFile=0x230, lpBuffer=0x56e938*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e938*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0038.710] GetProcessHeap () returned 0x560000 [0038.710] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e938, Size=0x30) returned 0x56e938 [0038.710] GetProcessHeap () returned 0x560000 [0038.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.710] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.710] GetProcessHeap () returned 0x560000 [0038.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x250) returned 0x56e0f8 [0038.710] ReadFile (in: hFile=0x230, lpBuffer=0x56e0f8, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x56e0f8*, lpNumberOfBytesRead=0x24ad7e8*=0x250, lpOverlapped=0x0) returned 1 [0038.710] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.710] WriteFile (in: hFile=0x230, lpBuffer=0x56e0f8*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x56e0f8*, lpNumberOfBytesWritten=0x24ad7e4*=0x250, lpOverlapped=0x0) returned 1 [0038.711] GetProcessHeap () returned 0x560000 [0038.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e0f8 | out: hHeap=0x560000) returned 1 [0038.711] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.711] WriteFile (in: hFile=0x230, lpBuffer=0x56e938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e938*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.712] CloseHandle (hObject=0x230) returned 1 [0038.713] GetProcessHeap () returned 0x560000 [0038.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0038.713] GetProcessHeap () returned 0x560000 [0038.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.713] GetProcessHeap () returned 0x560000 [0038.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.713] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd" [0038.713] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd.badday") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd.badday" [0038.713] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd.badday" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.badday"), dwFlags=0x1) returned 1 [0038.714] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.714] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.714] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.714] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.714] GetProcessHeap () returned 0x560000 [0038.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a98 | out: hHeap=0x560000) returned 1 [0038.714] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0038.714] lstrcmpiW (lpString1="resources", lpString2=".") returned 1 [0038.714] lstrcmpiW (lpString1="resources", lpString2="..") returned 1 [0038.714] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="resources" | out: lpString1="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0038.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="resources", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.714] GetProcessHeap () returned 0x560000 [0038.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0038.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="resources", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="resources", lpUsedDefaultChar=0x0) returned 10 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0038.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0038.715] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0038.715] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0038.716] GetProcessHeap () returned 0x560000 [0038.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a158 [0038.716] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\") returned 30 [0038.716] GetProcessHeap () returned 0x560000 [0038.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3e) returned 0x5730b8 [0038.716] lstrcpyW (in: lpString1=0x5730b8, lpString2="C:\\Windows10Upgrade\\resources\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0038.716] GetProcessHeap () returned 0x560000 [0038.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.716] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0038.716] lstrcmpiW (lpString1="upgrader_default.log", lpString2=".") returned 1 [0038.716] lstrcmpiW (lpString1="upgrader_default.log", lpString2="..") returned 1 [0038.716] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0038.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_default.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0038.716] GetProcessHeap () returned 0x560000 [0038.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576838 [0038.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_default.log", cchWideChar=-1, lpMultiByteStr=0x576838, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upgrader_default.log", lpUsedDefaultChar=0x0) returned 21 [0038.716] lstrlenA (lpString="upgrader_default.log") returned 20 [0038.716] lstrlenA (lpString=".badday") returned 7 [0038.716] lstrlenA (lpString=".badday") returned 7 [0038.716] lstrlenA (lpString="upgrader_default.log") returned 20 [0038.716] lstrcmpiA (lpString1="ult.log", lpString2=".badday") returned 1 [0038.716] lstrcmpiW (lpString1="upgrader_default.log", lpString2="how_to_back_files.html") returned 1 [0038.716] lstrcmpiW (lpString1="upgrader_default.log", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.716] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.716] lstrcmpiW (lpString1="upgrader_default.log", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0038.716] GetProcessHeap () returned 0x560000 [0038.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0038.716] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.717] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=250186) returned 1 [0038.717] GetProcessHeap () returned 0x560000 [0038.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.717] GetProcessHeap () returned 0x560000 [0038.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.717] lstrlenW (lpString="C:\\Windows10Upgrade\\upgrader_default.log") returned 40 [0038.717] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.717] GetProcessHeap () returned 0x560000 [0038.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.717] GetProcessHeap () returned 0x560000 [0038.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x56e970 [0038.717] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.717] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.718] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.718] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.718] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.718] lstrlenA (lpString="010001") returned 6 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e90 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0038.718] GetProcessHeap () returned 0x560000 [0038.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0038.718] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584c50 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c50 | out: hHeap=0x560000) returned 1 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e5e8 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584a10 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e5e8 | out: hHeap=0x560000) returned 1 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0038.719] GetProcessHeap () returned 0x560000 [0038.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.720] GetProcessHeap () returned 0x560000 [0038.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.721] GetProcessHeap () returned 0x560000 [0038.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.721] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.722] GetProcessHeap () returned 0x560000 [0038.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.723] GetProcessHeap () returned 0x560000 [0038.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0038.742] GetProcessHeap () returned 0x560000 [0038.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0038.743] GetProcessHeap () returned 0x560000 [0038.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0038.743] GetProcessHeap () returned 0x560000 [0038.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0038.743] GetProcessHeap () returned 0x560000 [0038.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.743] GetProcessHeap () returned 0x560000 [0038.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.743] WriteFile (in: hFile=0x230, lpBuffer=0x56e970*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e970*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0038.746] GetProcessHeap () returned 0x560000 [0038.746] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e970, Size=0x30) returned 0x56e970 [0038.746] GetProcessHeap () returned 0x560000 [0038.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.746] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.746] GetProcessHeap () returned 0x560000 [0038.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3d150) returned 0x58eb28 [0038.751] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x3d150, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x3d150, lpOverlapped=0x0) returned 1 [0038.755] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.755] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x3d150, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x3d150, lpOverlapped=0x0) returned 1 [0038.767] GetProcessHeap () returned 0x560000 [0038.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0038.767] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.767] WriteFile (in: hFile=0x230, lpBuffer=0x56e970*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e970*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.768] CloseHandle (hObject=0x230) returned 1 [0038.774] GetProcessHeap () returned 0x560000 [0038.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0038.774] GetProcessHeap () returned 0x560000 [0038.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.774] GetProcessHeap () returned 0x560000 [0038.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.774] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0038.774] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_default.log", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log.badday") returned="C:\\Windows10Upgrade\\upgrader_default.log.badday" [0038.774] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_default.log.badday" (normalized: "c:\\windows10upgrade\\upgrader_default.log.badday"), dwFlags=0x1) returned 1 [0038.774] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\upgrader_default.log" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.774] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.774] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.774] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.774] GetProcessHeap () returned 0x560000 [0038.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576838 | out: hHeap=0x560000) returned 1 [0038.775] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0038.775] lstrcmpiW (lpString1="upgrader_win10.log", lpString2=".") returned 1 [0038.775] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="..") returned 1 [0038.775] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0038.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_win10.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.775] GetProcessHeap () returned 0x560000 [0038.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576a58 [0038.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_win10.log", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upgrader_win10.log", lpUsedDefaultChar=0x0) returned 19 [0038.775] lstrlenA (lpString="upgrader_win10.log") returned 18 [0038.775] lstrlenA (lpString=".badday") returned 7 [0038.775] lstrlenA (lpString=".badday") returned 7 [0038.775] lstrlenA (lpString="upgrader_win10.log") returned 18 [0038.775] lstrcmpiA (lpString1="n10.log", lpString2=".badday") returned 1 [0038.775] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="how_to_back_files.html") returned 1 [0038.775] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.775] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.775] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0038.775] GetProcessHeap () returned 0x560000 [0038.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0038.775] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.775] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=20548) returned 1 [0038.775] GetProcessHeap () returned 0x560000 [0038.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.776] GetProcessHeap () returned 0x560000 [0038.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.776] lstrlenW (lpString="C:\\Windows10Upgrade\\upgrader_win10.log") returned 38 [0038.776] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.776] GetProcessHeap () returned 0x560000 [0038.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.776] GetProcessHeap () returned 0x560000 [0038.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x56e9a8 [0038.776] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.776] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.776] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.776] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.776] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.776] GetProcessHeap () returned 0x560000 [0038.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.777] lstrlenA (lpString="010001") returned 6 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584860 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585160 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0038.777] GetProcessHeap () returned 0x560000 [0038.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e750 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d70 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e750 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.778] GetProcessHeap () returned 0x560000 [0038.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.778] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.779] GetProcessHeap () returned 0x560000 [0038.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.779] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.780] GetProcessHeap () returned 0x560000 [0038.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.780] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.781] GetProcessHeap () returned 0x560000 [0038.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585160 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584860 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.782] GetProcessHeap () returned 0x560000 [0038.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.782] WriteFile (in: hFile=0x230, lpBuffer=0x56e9a8*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e9a8*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0038.786] GetProcessHeap () returned 0x560000 [0038.786] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e9a8, Size=0x30) returned 0x56e9a8 [0038.786] GetProcessHeap () returned 0x560000 [0038.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.786] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.786] GetProcessHeap () returned 0x560000 [0038.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5050) returned 0x58eb28 [0038.786] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x5050, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x5050, lpOverlapped=0x0) returned 1 [0038.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.787] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x5050, lpOverlapped=0x0) returned 1 [0038.788] GetProcessHeap () returned 0x560000 [0038.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0038.790] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.790] WriteFile (in: hFile=0x230, lpBuffer=0x56e9a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e9a8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.791] CloseHandle (hObject=0x230) returned 1 [0038.792] GetProcessHeap () returned 0x560000 [0038.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0038.792] GetProcessHeap () returned 0x560000 [0038.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.793] GetProcessHeap () returned 0x560000 [0038.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.793] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0038.793] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log.badday") returned="C:\\Windows10Upgrade\\upgrader_win10.log.badday" [0038.793] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_win10.log.badday" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.badday"), dwFlags=0x1) returned 1 [0038.793] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\upgrader_win10.log" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.793] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.793] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.793] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.793] GetProcessHeap () returned 0x560000 [0038.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0038.793] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0038.793] lstrcmpiW (lpString1="wimgapi.dll", lpString2=".") returned 1 [0038.793] lstrcmpiW (lpString1="wimgapi.dll", lpString2="..") returned 1 [0038.793] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="wimgapi.dll" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll") returned="C:\\Windows10Upgrade\\wimgapi.dll" [0038.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimgapi.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.794] GetProcessHeap () returned 0x560000 [0038.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0038.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimgapi.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimgapi.dll", lpUsedDefaultChar=0x0) returned 12 [0038.794] lstrlenA (lpString="wimgapi.dll") returned 11 [0038.794] lstrlenA (lpString=".badday") returned 7 [0038.794] lstrlenA (lpString=".badday") returned 7 [0038.794] lstrlenA (lpString="wimgapi.dll") returned 11 [0038.794] lstrcmpiA (lpString1="api.dll", lpString2=".badday") returned 1 [0038.794] lstrcmpiW (lpString1="wimgapi.dll", lpString2="how_to_back_files.html") returned 1 [0038.794] lstrcmpiW (lpString1="wimgapi.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.794] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.794] lstrcmpiW (lpString1="wimgapi.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0038.794] GetProcessHeap () returned 0x560000 [0038.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d490 [0038.794] CreateFileW (lpFileName="C:\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.795] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=557256) returned 1 [0038.795] GetProcessHeap () returned 0x560000 [0038.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.795] GetProcessHeap () returned 0x560000 [0038.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.795] lstrlenW (lpString="C:\\Windows10Upgrade\\wimgapi.dll") returned 31 [0038.795] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.795] GetProcessHeap () returned 0x560000 [0038.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.795] GetProcessHeap () returned 0x560000 [0038.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56e9e0 [0038.795] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.795] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.796] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.796] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.796] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.796] lstrlenA (lpString="010001") returned 6 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584aa0 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e5e8 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0038.796] GetProcessHeap () returned 0x560000 [0038.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e480 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584b30 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e480 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b30 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.797] GetProcessHeap () returned 0x560000 [0038.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.797] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.798] GetProcessHeap () returned 0x560000 [0038.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.798] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0038.799] GetProcessHeap () returned 0x560000 [0038.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.800] GetProcessHeap () returned 0x560000 [0038.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e5e8 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.801] GetProcessHeap () returned 0x560000 [0038.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.801] WriteFile (in: hFile=0x230, lpBuffer=0x56e9e0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e9e0*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0038.809] GetProcessHeap () returned 0x560000 [0038.809] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e9e0, Size=0x30) returned 0x56e9e0 [0038.809] GetProcessHeap () returned 0x560000 [0038.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0038.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.809] GetProcessHeap () returned 0x560000 [0038.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x880d0) returned 0x24b2020 [0038.819] ReadFile (in: hFile=0x230, lpBuffer=0x24b2020, nNumberOfBytesToRead=0x880d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b2020*, lpNumberOfBytesRead=0x24ad7e8*=0x880d0, lpOverlapped=0x0) returned 1 [0038.828] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0038.828] WriteFile (in: hFile=0x230, lpBuffer=0x24b2020*, nNumberOfBytesToWrite=0x880d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b2020*, lpNumberOfBytesWritten=0x24ad7e4*=0x880d0, lpOverlapped=0x0) returned 1 [0038.884] GetProcessHeap () returned 0x560000 [0038.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b2020 | out: hHeap=0x560000) returned 1 [0038.886] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.886] WriteFile (in: hFile=0x230, lpBuffer=0x56e9e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e9e0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0038.888] CloseHandle (hObject=0x230) returned 1 [0038.897] GetProcessHeap () returned 0x560000 [0038.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d490 | out: hHeap=0x560000) returned 1 [0038.897] GetProcessHeap () returned 0x560000 [0038.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0038.897] GetProcessHeap () returned 0x560000 [0038.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0038.897] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\wimgapi.dll" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll") returned="C:\\Windows10Upgrade\\wimgapi.dll" [0038.897] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\wimgapi.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll.badday") returned="C:\\Windows10Upgrade\\wimgapi.dll.badday" [0038.897] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), lpNewFileName="C:\\Windows10Upgrade\\wimgapi.dll.badday" (normalized: "c:\\windows10upgrade\\wimgapi.dll.badday"), dwFlags=0x1) returned 1 [0038.897] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\wimgapi.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0038.897] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0038.897] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0038.897] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0038.898] GetProcessHeap () returned 0x560000 [0038.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0038.898] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0038.898] lstrcmpiW (lpString1="windlp.dll", lpString2=".") returned 1 [0038.898] lstrcmpiW (lpString1="windlp.dll", lpString2="..") returned 1 [0038.898] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="windlp.dll" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll") returned="C:\\Windows10Upgrade\\windlp.dll" [0038.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windlp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.898] GetProcessHeap () returned 0x560000 [0038.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0038.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windlp.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windlp.dll", lpUsedDefaultChar=0x0) returned 11 [0038.898] lstrlenA (lpString="windlp.dll") returned 10 [0038.898] lstrlenA (lpString=".badday") returned 7 [0038.898] lstrlenA (lpString=".badday") returned 7 [0038.898] lstrlenA (lpString="windlp.dll") returned 10 [0038.898] lstrcmpiA (lpString1="dlp.dll", lpString2=".badday") returned 1 [0038.898] lstrcmpiW (lpString1="windlp.dll", lpString2="how_to_back_files.html") returned 1 [0038.898] lstrcmpiW (lpString1="windlp.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0038.898] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0038.898] lstrcmpiW (lpString1="windlp.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0038.898] GetProcessHeap () returned 0x560000 [0038.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0038.898] CreateFileW (lpFileName="C:\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0038.898] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=915656) returned 1 [0038.898] GetProcessHeap () returned 0x560000 [0038.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0038.899] GetProcessHeap () returned 0x560000 [0038.899] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0038.899] lstrlenW (lpString="C:\\Windows10Upgrade\\windlp.dll") returned 30 [0038.899] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0038.899] GetProcessHeap () returned 0x560000 [0038.899] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0038.899] GetProcessHeap () returned 0x560000 [0038.899] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56ea18 [0038.899] lstrlenA (lpString="rsa_encrypt") returned 11 [0038.899] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0038.899] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0038.899] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0038.899] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0038.899] GetProcessHeap () returned 0x560000 [0038.899] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0038.899] lstrlenA (lpString="010001") returned 6 [0038.899] GetProcessHeap () returned 0x560000 [0038.899] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ce0 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a068 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e618 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584d70 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0038.900] GetProcessHeap () returned 0x560000 [0038.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e6c0 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585160 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e6c0 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585160 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.901] GetProcessHeap () returned 0x560000 [0038.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0038.902] GetProcessHeap () returned 0x560000 [0038.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.903] GetProcessHeap () returned 0x560000 [0038.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0038.903] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.904] GetProcessHeap () returned 0x560000 [0038.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0038.904] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e618 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ce0 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0038.905] GetProcessHeap () returned 0x560000 [0038.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0038.905] WriteFile (in: hFile=0x230, lpBuffer=0x56ea18*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ea18*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0039.033] GetProcessHeap () returned 0x560000 [0039.033] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ea18, Size=0x30) returned 0x56ea18 [0039.033] GetProcessHeap () returned 0x560000 [0039.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.033] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.033] GetProcessHeap () returned 0x560000 [0039.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xdf8c8) returned 0x24b5020 [0039.047] ReadFile (in: hFile=0x230, lpBuffer=0x24b5020, nNumberOfBytesToRead=0xdf8c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b5020*, lpNumberOfBytesRead=0x24ad7e8*=0xdf8c8, lpOverlapped=0x0) returned 1 [0039.063] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.063] WriteFile (in: hFile=0x230, lpBuffer=0x24b5020*, nNumberOfBytesToWrite=0xdf8c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b5020*, lpNumberOfBytesWritten=0x24ad7e4*=0xdf8c8, lpOverlapped=0x0) returned 1 [0039.126] GetProcessHeap () returned 0x560000 [0039.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b5020 | out: hHeap=0x560000) returned 1 [0039.131] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.131] WriteFile (in: hFile=0x230, lpBuffer=0x56ea18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ea18*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.132] CloseHandle (hObject=0x230) returned 1 [0039.145] GetProcessHeap () returned 0x560000 [0039.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0039.146] GetProcessHeap () returned 0x560000 [0039.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.146] GetProcessHeap () returned 0x560000 [0039.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.146] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\windlp.dll" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll") returned="C:\\Windows10Upgrade\\windlp.dll" [0039.146] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\windlp.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll.badday") returned="C:\\Windows10Upgrade\\windlp.dll.badday" [0039.146] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), lpNewFileName="C:\\Windows10Upgrade\\windlp.dll.badday" (normalized: "c:\\windows10upgrade\\windlp.dll.badday"), dwFlags=0x1) returned 1 [0039.147] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\windlp.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0039.147] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0039.147] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0039.147] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0039.147] GetProcessHeap () returned 0x560000 [0039.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.147] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0039.147] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2=".") returned 1 [0039.147] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="..") returned 1 [0039.147] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Windows10UpgraderApp.exe" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0039.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10UpgraderApp.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0039.147] GetProcessHeap () returned 0x560000 [0039.147] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d328 [0039.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10UpgraderApp.exe", cchWideChar=-1, lpMultiByteStr=0x57d328, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows10UpgraderApp.exe", lpUsedDefaultChar=0x0) returned 25 [0039.148] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0039.148] lstrlenA (lpString=".badday") returned 7 [0039.148] lstrlenA (lpString=".badday") returned 7 [0039.148] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0039.148] lstrcmpiA (lpString1="App.exe", lpString2=".badday") returned 1 [0039.148] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="how_to_back_files.html") returned 1 [0039.148] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.148] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.148] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.148] GetProcessHeap () returned 0x560000 [0039.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0039.148] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.149] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1415880) returned 1 [0039.149] GetProcessHeap () returned 0x560000 [0039.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.149] GetProcessHeap () returned 0x560000 [0039.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.149] lstrlenW (lpString="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned 44 [0039.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.149] GetProcessHeap () returned 0x560000 [0039.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.149] GetProcessHeap () returned 0x560000 [0039.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56ea50 [0039.149] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.149] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.150] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.150] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.150] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.150] lstrlenA (lpString="010001") returned 6 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5842c0 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.150] GetProcessHeap () returned 0x560000 [0039.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584860 [0039.150] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584860 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e7e0 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5848f0 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e7e0 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.151] GetProcessHeap () returned 0x560000 [0039.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.151] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.152] GetProcessHeap () returned 0x560000 [0039.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.153] GetProcessHeap () returned 0x560000 [0039.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.154] GetProcessHeap () returned 0x560000 [0039.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.155] GetProcessHeap () returned 0x560000 [0039.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.155] WriteFile (in: hFile=0x230, lpBuffer=0x56ea50*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ea50*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0039.159] GetProcessHeap () returned 0x560000 [0039.159] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ea50, Size=0x30) returned 0x56ea50 [0039.159] GetProcessHeap () returned 0x560000 [0039.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.159] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.159] GetProcessHeap () returned 0x560000 [0039.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x159ad0) returned 0x24b4020 [0039.181] ReadFile (in: hFile=0x230, lpBuffer=0x24b4020, nNumberOfBytesToRead=0x159ad0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b4020*, lpNumberOfBytesRead=0x24ad7e8*=0x159ad0, lpOverlapped=0x0) returned 1 [0039.209] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.209] WriteFile (in: hFile=0x230, lpBuffer=0x24b4020*, nNumberOfBytesToWrite=0x159ad0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b4020*, lpNumberOfBytesWritten=0x24ad7e4*=0x159ad0, lpOverlapped=0x0) returned 1 [0039.274] GetProcessHeap () returned 0x560000 [0039.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b4020 | out: hHeap=0x560000) returned 1 [0039.280] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.280] WriteFile (in: hFile=0x230, lpBuffer=0x56ea50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ea50*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.281] CloseHandle (hObject=0x230) returned 1 [0039.303] GetProcessHeap () returned 0x560000 [0039.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0039.303] GetProcessHeap () returned 0x560000 [0039.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.303] GetProcessHeap () returned 0x560000 [0039.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.303] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0039.303] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.badday") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.badday" [0039.303] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), lpNewFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.badday" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.badday"), dwFlags=0x1) returned 1 [0039.304] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0039.304] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0039.304] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0039.304] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0039.304] GetProcessHeap () returned 0x560000 [0039.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0039.304] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0039.304] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2=".") returned 1 [0039.304] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="..") returned 1 [0039.304] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="WinREBootApp32.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0039.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp32.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.304] GetProcessHeap () returned 0x560000 [0039.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576b78 [0039.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp32.exe", cchWideChar=-1, lpMultiByteStr=0x576b78, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinREBootApp32.exe", lpUsedDefaultChar=0x0) returned 19 [0039.304] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0039.304] lstrlenA (lpString=".badday") returned 7 [0039.304] lstrlenA (lpString=".badday") returned 7 [0039.304] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0039.304] lstrcmpiA (lpString1="p32.exe", lpString2=".badday") returned 1 [0039.304] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="how_to_back_files.html") returned 1 [0039.304] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.304] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.304] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.304] GetProcessHeap () returned 0x560000 [0039.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0039.304] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.305] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=25288) returned 1 [0039.305] GetProcessHeap () returned 0x560000 [0039.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.305] GetProcessHeap () returned 0x560000 [0039.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.305] lstrlenW (lpString="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned 38 [0039.305] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.305] GetProcessHeap () returned 0x560000 [0039.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.305] GetProcessHeap () returned 0x560000 [0039.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56ea88 [0039.305] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.305] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.306] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.306] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.306] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.306] lstrlenA (lpString="010001") returned 6 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e90 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5848f0 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.306] GetProcessHeap () returned 0x560000 [0039.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0039.306] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e780 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585160 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e780 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585160 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.307] GetProcessHeap () returned 0x560000 [0039.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.308] GetProcessHeap () returned 0x560000 [0039.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.309] GetProcessHeap () returned 0x560000 [0039.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.310] GetProcessHeap () returned 0x560000 [0039.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.310] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.311] GetProcessHeap () returned 0x560000 [0039.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.311] WriteFile (in: hFile=0x230, lpBuffer=0x56ea88*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ea88*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0039.316] GetProcessHeap () returned 0x560000 [0039.316] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ea88, Size=0x30) returned 0x56ea88 [0039.316] GetProcessHeap () returned 0x560000 [0039.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.316] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.317] GetProcessHeap () returned 0x560000 [0039.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x62c8) returned 0x58eb28 [0039.318] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x62c8, lpOverlapped=0x0) returned 1 [0039.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.319] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x62c8, lpOverlapped=0x0) returned 1 [0039.323] GetProcessHeap () returned 0x560000 [0039.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.324] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.324] WriteFile (in: hFile=0x230, lpBuffer=0x56ea88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ea88*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.325] CloseHandle (hObject=0x230) returned 1 [0039.326] GetProcessHeap () returned 0x560000 [0039.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0039.326] GetProcessHeap () returned 0x560000 [0039.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.326] GetProcessHeap () returned 0x560000 [0039.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.326] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0039.326] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe.badday") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe.badday" [0039.326] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.badday" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.badday"), dwFlags=0x1) returned 1 [0039.327] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0039.327] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0039.327] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0039.327] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0039.327] GetProcessHeap () returned 0x560000 [0039.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b78 | out: hHeap=0x560000) returned 1 [0039.327] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0039.327] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2=".") returned 1 [0039.327] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="..") returned 1 [0039.327] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="WinREBootApp64.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0039.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp64.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.327] GetProcessHeap () returned 0x560000 [0039.327] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0039.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp64.exe", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinREBootApp64.exe", lpUsedDefaultChar=0x0) returned 19 [0039.327] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0039.327] lstrlenA (lpString=".badday") returned 7 [0039.327] lstrlenA (lpString=".badday") returned 7 [0039.327] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0039.327] lstrcmpiA (lpString1="p64.exe", lpString2=".badday") returned 1 [0039.327] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="how_to_back_files.html") returned 1 [0039.328] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.328] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.328] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.328] GetProcessHeap () returned 0x560000 [0039.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0039.328] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.328] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=25800) returned 1 [0039.328] GetProcessHeap () returned 0x560000 [0039.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.328] GetProcessHeap () returned 0x560000 [0039.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.328] lstrlenW (lpString="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned 38 [0039.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.328] GetProcessHeap () returned 0x560000 [0039.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.328] GetProcessHeap () returned 0x560000 [0039.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56eac0 [0039.328] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.328] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.329] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.329] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.329] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.329] lstrlenA (lpString="010001") returned 6 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f20 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584aa0 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0039.329] GetProcessHeap () returned 0x560000 [0039.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.329] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584980 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584980 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e600 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584bc0 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e600 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.330] GetProcessHeap () returned 0x560000 [0039.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.330] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.331] GetProcessHeap () returned 0x560000 [0039.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.332] GetProcessHeap () returned 0x560000 [0039.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.332] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.333] GetProcessHeap () returned 0x560000 [0039.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.333] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.334] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f20 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.335] GetProcessHeap () returned 0x560000 [0039.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.335] WriteFile (in: hFile=0x230, lpBuffer=0x56eac0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eac0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0039.342] GetProcessHeap () returned 0x560000 [0039.342] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56eac0, Size=0x30) returned 0x56eac0 [0039.342] GetProcessHeap () returned 0x560000 [0039.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.342] GetProcessHeap () returned 0x560000 [0039.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x64c8) returned 0x58eb28 [0039.344] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x64c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x64c8, lpOverlapped=0x0) returned 1 [0039.345] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.345] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x64c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x64c8, lpOverlapped=0x0) returned 1 [0039.346] GetProcessHeap () returned 0x560000 [0039.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.346] WriteFile (in: hFile=0x230, lpBuffer=0x56eac0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eac0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.347] CloseHandle (hObject=0x230) returned 1 [0039.348] GetProcessHeap () returned 0x560000 [0039.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0039.348] GetProcessHeap () returned 0x560000 [0039.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.348] GetProcessHeap () returned 0x560000 [0039.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.348] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0039.348] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe.badday") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe.badday" [0039.348] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.badday" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.badday"), dwFlags=0x1) returned 1 [0039.349] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0039.349] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0039.349] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\how_to_back_files.html" [0039.349] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\how_to_back_files.html")) returned 0x20 [0039.349] GetProcessHeap () returned 0x560000 [0039.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0039.350] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0039.350] FindClose (in: hFindFile=0x579748 | out: hFindFile=0x579748) returned 1 [0039.350] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0039.350] GetProcessHeap () returned 0x560000 [0039.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5730b8 | out: hHeap=0x560000) returned 1 [0039.350] GetProcessHeap () returned 0x560000 [0039.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.350] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\") returned 30 [0039.350] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\*") returned="C:\\Windows10Upgrade\\resources\\*" [0039.350] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0039.350] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0039.350] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.350] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0039.350] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0039.350] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0039.350] lstrcmpiW (lpString1="amd64", lpString2=".") returned 1 [0039.350] lstrcmpiW (lpString1="amd64", lpString2="..") returned 1 [0039.350] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="amd64" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0039.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amd64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0039.350] GetProcessHeap () returned 0x560000 [0039.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a198 [0039.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amd64", cchWideChar=-1, lpMultiByteStr=0x58a198, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amd64", lpUsedDefaultChar=0x0) returned 6 [0039.350] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0039.350] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0039.350] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0039.350] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0039.350] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0039.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0039.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0039.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0039.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0039.352] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0039.352] GetProcessHeap () returned 0x560000 [0039.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a038 [0039.352] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\") returned 36 [0039.352] GetProcessHeap () returned 0x560000 [0039.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4a) returned 0x58b800 [0039.352] lstrcpyW (in: lpString1=0x58b800, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0039.352] GetProcessHeap () returned 0x560000 [0039.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.352] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0039.352] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2=".") returned 1 [0039.352] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="..") returned 1 [0039.352] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0039.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompatShared.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.352] GetProcessHeap () returned 0x560000 [0039.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0039.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompatShared.txt", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompatShared.txt", lpUsedDefaultChar=0x0) returned 19 [0039.352] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0039.352] lstrlenA (lpString=".badday") returned 7 [0039.352] lstrlenA (lpString=".badday") returned 7 [0039.352] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0039.352] lstrcmpiA (lpString1="red.txt", lpString2=".badday") returned 1 [0039.352] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="how_to_back_files.html") returned 1 [0039.352] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.352] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.352] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.352] GetProcessHeap () returned 0x560000 [0039.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0039.352] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.353] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=825371) returned 1 [0039.353] GetProcessHeap () returned 0x560000 [0039.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.353] GetProcessHeap () returned 0x560000 [0039.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.353] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned 48 [0039.353] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.353] GetProcessHeap () returned 0x560000 [0039.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x385) returned 0x56eaf8 [0039.354] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.354] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.354] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.354] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.354] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.354] lstrlenA (lpString="010001") returned 6 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a10 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.354] GetProcessHeap () returned 0x560000 [0039.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846b0 [0039.354] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584fb0 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fb0 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e380 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5847d0 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e380 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0039.355] GetProcessHeap () returned 0x560000 [0039.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847d0 | out: hHeap=0x560000) returned 1 [0039.355] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.356] GetProcessHeap () returned 0x560000 [0039.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.357] GetProcessHeap () returned 0x560000 [0039.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.358] GetProcessHeap () returned 0x560000 [0039.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0039.359] GetProcessHeap () returned 0x560000 [0039.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.360] GetProcessHeap () returned 0x560000 [0039.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0039.360] GetProcessHeap () returned 0x560000 [0039.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.360] GetProcessHeap () returned 0x560000 [0039.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.360] GetProcessHeap () returned 0x560000 [0039.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.360] WriteFile (in: hFile=0x230, lpBuffer=0x56eaf8*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eaf8*, lpNumberOfBytesWritten=0x24ad864*=0x385, lpOverlapped=0x0) returned 1 [0039.367] GetProcessHeap () returned 0x560000 [0039.367] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56eaf8, Size=0x30) returned 0x56eaf8 [0039.367] GetProcessHeap () returned 0x560000 [0039.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.368] GetProcessHeap () returned 0x560000 [0039.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc9820) returned 0x24bc020 [0039.381] ReadFile (in: hFile=0x230, lpBuffer=0x24bc020, nNumberOfBytesToRead=0xc9820, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24bc020*, lpNumberOfBytesRead=0x24ad7e8*=0xc9820, lpOverlapped=0x0) returned 1 [0039.398] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.398] WriteFile (in: hFile=0x230, lpBuffer=0x24bc020*, nNumberOfBytesToWrite=0xc9820, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24bc020*, lpNumberOfBytesWritten=0x24ad7e4*=0xc9820, lpOverlapped=0x0) returned 1 [0039.426] GetProcessHeap () returned 0x560000 [0039.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24bc020 | out: hHeap=0x560000) returned 1 [0039.429] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.430] WriteFile (in: hFile=0x230, lpBuffer=0x56eaf8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eaf8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.430] CloseHandle (hObject=0x230) returned 1 [0039.443] GetProcessHeap () returned 0x560000 [0039.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0039.443] GetProcessHeap () returned 0x560000 [0039.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.443] GetProcessHeap () returned 0x560000 [0039.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.443] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0039.443] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.badday") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.badday" [0039.443] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.badday" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.badday"), dwFlags=0x1) returned 1 [0039.443] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: pszPath="C:\\Windows10Upgrade\\resources") returned 1 [0039.443] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources" | out: pszPath="C:\\Windows10Upgrade\\resources\\") returned="" [0039.443] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\how_to_back_files.html" [0039.443] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\how_to_back_files.html")) returned 0xffffffff [0039.444] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0039.445] GetProcessHeap () returned 0x560000 [0039.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.445] GetProcessHeap () returned 0x560000 [0039.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.452] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.453] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.463] GetProcessHeap () returned 0x560000 [0039.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.463] GetProcessHeap () returned 0x560000 [0039.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.463] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0039.463] GetProcessHeap () returned 0x560000 [0039.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.463] GetProcessHeap () returned 0x560000 [0039.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.471] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.472] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.479] GetProcessHeap () returned 0x560000 [0039.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.479] GetProcessHeap () returned 0x560000 [0039.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.479] CloseHandle (hObject=0x230) returned 1 [0039.479] GetProcessHeap () returned 0x560000 [0039.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0039.479] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0039.479] lstrcmpiW (lpString1="i386", lpString2=".") returned 1 [0039.479] lstrcmpiW (lpString1="i386", lpString2="..") returned 1 [0039.479] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="i386" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0039.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i386", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0039.480] GetProcessHeap () returned 0x560000 [0039.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a058 [0039.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i386", cchWideChar=-1, lpMultiByteStr=0x58a058, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i386", lpUsedDefaultChar=0x0) returned 5 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0039.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0039.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0039.481] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0039.481] GetProcessHeap () returned 0x560000 [0039.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a068 [0039.481] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\") returned 35 [0039.481] GetProcessHeap () returned 0x560000 [0039.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x48) returned 0x585910 [0039.481] lstrcpyW (in: lpString1=0x585910, lpString2="C:\\Windows10Upgrade\\resources\\i386\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0039.481] GetProcessHeap () returned 0x560000 [0039.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.481] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0039.481] lstrcmpiW (lpString1="ux", lpString2=".") returned 1 [0039.481] lstrcmpiW (lpString1="ux", lpString2="..") returned 1 [0039.481] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="ux" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0039.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ux", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0039.481] GetProcessHeap () returned 0x560000 [0039.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3) returned 0x58a158 [0039.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ux", cchWideChar=-1, lpMultiByteStr=0x58a158, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ux", lpUsedDefaultChar=0x0) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0039.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0039.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0039.483] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0039.483] GetProcessHeap () returned 0x560000 [0039.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fd8 [0039.483] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\") returned 33 [0039.483] GetProcessHeap () returned 0x560000 [0039.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x44) returned 0x5855f0 [0039.483] lstrcpyW (in: lpString1=0x5855f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0039.483] GetProcessHeap () returned 0x560000 [0039.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.483] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0039.483] FindClose (in: hFindFile=0x5797c8 | out: hFindFile=0x5797c8) returned 1 [0039.483] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0039.483] GetProcessHeap () returned 0x560000 [0039.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5855f0 | out: hHeap=0x560000) returned 1 [0039.483] GetProcessHeap () returned 0x560000 [0039.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.483] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\") returned 33 [0039.483] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\*" [0039.483] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579488 [0039.486] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0039.486] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.486] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0039.486] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0039.486] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="block.png", cAlternateFileName="")) returned 1 [0039.486] lstrcmpiW (lpString1="block.png", lpString2=".") returned 1 [0039.486] lstrcmpiW (lpString1="block.png", lpString2="..") returned 1 [0039.486] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0039.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="block.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.486] GetProcessHeap () returned 0x560000 [0039.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0039.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="block.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="block.png", lpUsedDefaultChar=0x0) returned 10 [0039.486] lstrlenA (lpString="block.png") returned 9 [0039.486] lstrlenA (lpString=".badday") returned 7 [0039.486] lstrlenA (lpString=".badday") returned 7 [0039.486] lstrlenA (lpString="block.png") returned 9 [0039.487] lstrcmpiA (lpString1="ock.png", lpString2=".badday") returned 1 [0039.487] lstrcmpiW (lpString1="block.png", lpString2="how_to_back_files.html") returned -1 [0039.487] lstrcmpiW (lpString1="block.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.487] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.487] lstrcmpiW (lpString1="block.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.487] GetProcessHeap () returned 0x560000 [0039.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0039.487] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.487] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=919) returned 1 [0039.487] GetProcessHeap () returned 0x560000 [0039.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.487] GetProcessHeap () returned 0x560000 [0039.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.487] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned 42 [0039.487] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.487] GetProcessHeap () returned 0x560000 [0039.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.487] GetProcessHeap () returned 0x560000 [0039.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x56eb30 [0039.487] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.487] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.488] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.488] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.488] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.488] lstrlenA (lpString="010001") returned 6 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584aa0 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e90 [0039.488] GetProcessHeap () returned 0x560000 [0039.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0039.488] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e3f8 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584860 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584860 | out: hHeap=0x560000) returned 1 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.489] GetProcessHeap () returned 0x560000 [0039.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e410 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5848f0 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e410 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.490] GetProcessHeap () returned 0x560000 [0039.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.490] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.491] GetProcessHeap () returned 0x560000 [0039.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.492] GetProcessHeap () returned 0x560000 [0039.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.492] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.493] GetProcessHeap () returned 0x560000 [0039.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.493] GetProcessHeap () returned 0x560000 [0039.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e3f8 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.494] GetProcessHeap () returned 0x560000 [0039.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.494] WriteFile (in: hFile=0x230, lpBuffer=0x56eb30*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eb30*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0039.498] GetProcessHeap () returned 0x560000 [0039.498] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56eb30, Size=0x30) returned 0x56eb30 [0039.498] GetProcessHeap () returned 0x560000 [0039.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.498] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.498] GetProcessHeap () returned 0x560000 [0039.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3a0) returned 0x56eb68 [0039.498] ReadFile (in: hFile=0x230, lpBuffer=0x56eb68, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x56eb68*, lpNumberOfBytesRead=0x24ad7e8*=0x3a0, lpOverlapped=0x0) returned 1 [0039.498] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.498] WriteFile (in: hFile=0x230, lpBuffer=0x56eb68*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x56eb68*, lpNumberOfBytesWritten=0x24ad7e4*=0x3a0, lpOverlapped=0x0) returned 1 [0039.499] GetProcessHeap () returned 0x560000 [0039.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56eb68 | out: hHeap=0x560000) returned 1 [0039.499] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.499] WriteFile (in: hFile=0x230, lpBuffer=0x56eb30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eb30*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.500] CloseHandle (hObject=0x230) returned 1 [0039.501] GetProcessHeap () returned 0x560000 [0039.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0039.501] GetProcessHeap () returned 0x560000 [0039.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.502] GetProcessHeap () returned 0x560000 [0039.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.502] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0039.502] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.badday" [0039.502] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.badday"), dwFlags=0x1) returned 1 [0039.502] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.502] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.502] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.502] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0xffffffff [0039.502] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0039.504] GetProcessHeap () returned 0x560000 [0039.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.504] GetProcessHeap () returned 0x560000 [0039.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.512] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.526] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.527] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.528] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.529] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.529] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.529] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.529] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.529] GetProcessHeap () returned 0x560000 [0039.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.529] GetProcessHeap () returned 0x560000 [0039.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.529] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0039.529] GetProcessHeap () returned 0x560000 [0039.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.529] GetProcessHeap () returned 0x560000 [0039.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.536] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.536] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.536] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.536] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.537] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.537] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.538] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.540] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.541] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.542] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.543] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.544] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.545] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0039.546] GetProcessHeap () returned 0x560000 [0039.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.546] GetProcessHeap () returned 0x560000 [0039.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.546] CloseHandle (hObject=0x230) returned 1 [0039.546] GetProcessHeap () returned 0x560000 [0039.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.546] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0039.546] lstrcmpiW (lpString1="bluelogo.png", lpString2=".") returned 1 [0039.546] lstrcmpiW (lpString1="bluelogo.png", lpString2="..") returned 1 [0039.546] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0039.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bluelogo.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.546] GetProcessHeap () returned 0x560000 [0039.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0039.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bluelogo.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bluelogo.png", lpUsedDefaultChar=0x0) returned 13 [0039.546] lstrlenA (lpString="bluelogo.png") returned 12 [0039.547] lstrlenA (lpString=".badday") returned 7 [0039.547] lstrlenA (lpString=".badday") returned 7 [0039.547] lstrlenA (lpString="bluelogo.png") returned 12 [0039.547] lstrcmpiA (lpString1="ogo.png", lpString2=".badday") returned 1 [0039.547] lstrcmpiW (lpString1="bluelogo.png", lpString2="how_to_back_files.html") returned -1 [0039.547] lstrcmpiW (lpString1="bluelogo.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.547] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.547] lstrcmpiW (lpString1="bluelogo.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.547] GetProcessHeap () returned 0x560000 [0039.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0039.547] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.548] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=7080) returned 1 [0039.548] GetProcessHeap () returned 0x560000 [0039.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.548] GetProcessHeap () returned 0x560000 [0039.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.548] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned 45 [0039.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.548] GetProcessHeap () returned 0x560000 [0039.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.548] GetProcessHeap () returned 0x560000 [0039.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56eb68 [0039.548] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.548] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.549] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.549] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.549] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.549] lstrlenA (lpString="010001") returned 6 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584500 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0039.549] GetProcessHeap () returned 0x560000 [0039.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.549] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4b8 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5848f0 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4d0 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584b30 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4d0 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b30 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.550] GetProcessHeap () returned 0x560000 [0039.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.550] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.551] GetProcessHeap () returned 0x560000 [0039.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.551] GetProcessHeap () returned 0x560000 [0039.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.552] GetProcessHeap () returned 0x560000 [0039.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.552] GetProcessHeap () returned 0x560000 [0039.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.552] GetProcessHeap () returned 0x560000 [0039.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.552] GetProcessHeap () returned 0x560000 [0039.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.552] GetProcessHeap () returned 0x560000 [0039.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.552] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.553] GetProcessHeap () returned 0x560000 [0039.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.554] GetProcessHeap () returned 0x560000 [0039.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.554] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4b8 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.555] GetProcessHeap () returned 0x560000 [0039.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.555] WriteFile (in: hFile=0x230, lpBuffer=0x56eb68*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eb68*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0039.559] GetProcessHeap () returned 0x560000 [0039.559] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56eb68, Size=0x30) returned 0x56eb68 [0039.559] GetProcessHeap () returned 0x560000 [0039.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.559] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.559] GetProcessHeap () returned 0x560000 [0039.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1bb0) returned 0x58eb28 [0039.559] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x1bb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x1bb0, lpOverlapped=0x0) returned 1 [0039.560] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.560] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x1bb0, lpOverlapped=0x0) returned 1 [0039.561] GetProcessHeap () returned 0x560000 [0039.561] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.561] WriteFile (in: hFile=0x230, lpBuffer=0x56eb68*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eb68*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.562] CloseHandle (hObject=0x230) returned 1 [0039.563] GetProcessHeap () returned 0x560000 [0039.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0039.563] GetProcessHeap () returned 0x560000 [0039.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.563] GetProcessHeap () returned 0x560000 [0039.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.563] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0039.563] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.badday" [0039.563] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.badday"), dwFlags=0x1) returned 1 [0039.564] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.564] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.564] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.564] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.564] GetProcessHeap () returned 0x560000 [0039.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.564] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0039.564] lstrcmpiW (lpString1="bullet.png", lpString2=".") returned 1 [0039.564] lstrcmpiW (lpString1="bullet.png", lpString2="..") returned 1 [0039.564] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0039.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bullet.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.564] GetProcessHeap () returned 0x560000 [0039.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0039.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bullet.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bullet.png", lpUsedDefaultChar=0x0) returned 11 [0039.564] lstrlenA (lpString="bullet.png") returned 10 [0039.564] lstrlenA (lpString=".badday") returned 7 [0039.564] lstrlenA (lpString=".badday") returned 7 [0039.564] lstrlenA (lpString="bullet.png") returned 10 [0039.564] lstrcmpiA (lpString1="let.png", lpString2=".badday") returned 1 [0039.565] lstrcmpiW (lpString1="bullet.png", lpString2="how_to_back_files.html") returned -1 [0039.565] lstrcmpiW (lpString1="bullet.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.565] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.565] lstrcmpiW (lpString1="bullet.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.565] GetProcessHeap () returned 0x560000 [0039.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0039.565] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.565] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=221) returned 1 [0039.565] GetProcessHeap () returned 0x560000 [0039.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.565] GetProcessHeap () returned 0x560000 [0039.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.565] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned 43 [0039.565] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.565] GetProcessHeap () returned 0x560000 [0039.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.565] GetProcessHeap () returned 0x560000 [0039.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x56eba0 [0039.565] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.565] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.566] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.566] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.566] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.566] lstrlenA (lpString="010001") returned 6 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0039.566] GetProcessHeap () returned 0x560000 [0039.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e158 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5848f0 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e3b0 [0039.567] GetProcessHeap () returned 0x560000 [0039.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.567] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584500 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e3b0 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.568] GetProcessHeap () returned 0x560000 [0039.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.568] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.569] GetProcessHeap () returned 0x560000 [0039.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.570] GetProcessHeap () returned 0x560000 [0039.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.570] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.571] GetProcessHeap () returned 0x560000 [0039.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.571] GetProcessHeap () returned 0x560000 [0039.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e158 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.572] GetProcessHeap () returned 0x560000 [0039.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.572] WriteFile (in: hFile=0x230, lpBuffer=0x56eba0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eba0*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0039.576] GetProcessHeap () returned 0x560000 [0039.576] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56eba0, Size=0x30) returned 0x56eba0 [0039.576] GetProcessHeap () returned 0x560000 [0039.576] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.576] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.576] GetProcessHeap () returned 0x560000 [0039.576] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe0) returned 0x5728f8 [0039.576] ReadFile (in: hFile=0x230, lpBuffer=0x5728f8, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5728f8*, lpNumberOfBytesRead=0x24ad7e8*=0xe0, lpOverlapped=0x0) returned 1 [0039.576] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.576] WriteFile (in: hFile=0x230, lpBuffer=0x5728f8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5728f8*, lpNumberOfBytesWritten=0x24ad7e4*=0xe0, lpOverlapped=0x0) returned 1 [0039.577] GetProcessHeap () returned 0x560000 [0039.577] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5728f8 | out: hHeap=0x560000) returned 1 [0039.577] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.577] WriteFile (in: hFile=0x230, lpBuffer=0x56eba0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56eba0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.578] CloseHandle (hObject=0x230) returned 1 [0039.579] GetProcessHeap () returned 0x560000 [0039.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0039.579] GetProcessHeap () returned 0x560000 [0039.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.579] GetProcessHeap () returned 0x560000 [0039.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.579] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0039.579] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.badday" [0039.579] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.badday"), dwFlags=0x1) returned 1 [0039.579] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.580] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.580] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.580] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.580] GetProcessHeap () returned 0x560000 [0039.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.580] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0039.580] lstrcmpiW (lpString1="default.css", lpString2=".") returned 1 [0039.580] lstrcmpiW (lpString1="default.css", lpString2="..") returned 1 [0039.580] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0039.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.580] GetProcessHeap () returned 0x560000 [0039.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0039.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.css", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.css", lpUsedDefaultChar=0x0) returned 12 [0039.580] lstrlenA (lpString="default.css") returned 11 [0039.580] lstrlenA (lpString=".badday") returned 7 [0039.580] lstrlenA (lpString=".badday") returned 7 [0039.580] lstrlenA (lpString="default.css") returned 11 [0039.580] lstrcmpiA (lpString1="ult.css", lpString2=".badday") returned 1 [0039.580] lstrcmpiW (lpString1="default.css", lpString2="how_to_back_files.html") returned -1 [0039.580] lstrcmpiW (lpString1="default.css", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.580] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.580] lstrcmpiW (lpString1="default.css", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.580] GetProcessHeap () returned 0x560000 [0039.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0039.580] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.581] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=5767) returned 1 [0039.581] GetProcessHeap () returned 0x560000 [0039.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.581] GetProcessHeap () returned 0x560000 [0039.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.581] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned 44 [0039.581] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.581] GetProcessHeap () returned 0x560000 [0039.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.581] GetProcessHeap () returned 0x560000 [0039.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x56ebd8 [0039.581] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.581] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.581] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.581] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.582] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.582] lstrlenA (lpString="010001") returned 6 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846b0 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e260 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b30 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.582] GetProcessHeap () returned 0x560000 [0039.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b30 | out: hHeap=0x560000) returned 1 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e368 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584fb0 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e368 | out: hHeap=0x560000) returned 1 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fb0 | out: hHeap=0x560000) returned 1 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.583] GetProcessHeap () returned 0x560000 [0039.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.584] GetProcessHeap () returned 0x560000 [0039.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.585] GetProcessHeap () returned 0x560000 [0039.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.585] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.586] GetProcessHeap () returned 0x560000 [0039.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.586] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.587] GetProcessHeap () returned 0x560000 [0039.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e260 | out: hHeap=0x560000) returned 1 [0039.588] GetProcessHeap () returned 0x560000 [0039.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0039.588] GetProcessHeap () returned 0x560000 [0039.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.588] GetProcessHeap () returned 0x560000 [0039.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0039.588] GetProcessHeap () returned 0x560000 [0039.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.588] GetProcessHeap () returned 0x560000 [0039.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.588] GetProcessHeap () returned 0x560000 [0039.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.588] WriteFile (in: hFile=0x230, lpBuffer=0x56ebd8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ebd8*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0039.591] GetProcessHeap () returned 0x560000 [0039.591] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ebd8, Size=0x30) returned 0x56ebd8 [0039.591] GetProcessHeap () returned 0x560000 [0039.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.591] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.591] GetProcessHeap () returned 0x560000 [0039.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1690) returned 0x58eb28 [0039.591] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x1690, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x1690, lpOverlapped=0x0) returned 1 [0039.592] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.592] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x1690, lpOverlapped=0x0) returned 1 [0039.593] GetProcessHeap () returned 0x560000 [0039.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.593] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.593] WriteFile (in: hFile=0x230, lpBuffer=0x56ebd8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ebd8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.594] CloseHandle (hObject=0x230) returned 1 [0039.595] GetProcessHeap () returned 0x560000 [0039.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0039.595] GetProcessHeap () returned 0x560000 [0039.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.595] GetProcessHeap () returned 0x560000 [0039.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.595] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0039.595] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css.badday" [0039.595] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.badday"), dwFlags=0x1) returned 1 [0039.595] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.595] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.595] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.595] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.595] GetProcessHeap () returned 0x560000 [0039.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.595] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default.htm", cAlternateFileName="")) returned 1 [0039.596] lstrcmpiW (lpString1="default.htm", lpString2=".") returned 1 [0039.596] lstrcmpiW (lpString1="default.htm", lpString2="..") returned 1 [0039.596] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0039.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.596] GetProcessHeap () returned 0x560000 [0039.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0039.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.htm", lpUsedDefaultChar=0x0) returned 12 [0039.596] lstrlenA (lpString="default.htm") returned 11 [0039.596] lstrlenA (lpString=".badday") returned 7 [0039.596] lstrlenA (lpString=".badday") returned 7 [0039.596] lstrlenA (lpString="default.htm") returned 11 [0039.596] lstrcmpiA (lpString1="ult.htm", lpString2=".badday") returned 1 [0039.596] lstrcmpiW (lpString1="default.htm", lpString2="how_to_back_files.html") returned -1 [0039.596] lstrcmpiW (lpString1="default.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.596] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.596] lstrcmpiW (lpString1="default.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.596] GetProcessHeap () returned 0x560000 [0039.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0039.596] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.596] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=62541) returned 1 [0039.596] GetProcessHeap () returned 0x560000 [0039.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.597] GetProcessHeap () returned 0x560000 [0039.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.597] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned 44 [0039.597] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.597] GetProcessHeap () returned 0x560000 [0039.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.597] GetProcessHeap () returned 0x560000 [0039.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56ec10 [0039.597] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.597] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.597] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.597] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.597] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.597] GetProcessHeap () returned 0x560000 [0039.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.597] lstrlenA (lpString="010001") returned 6 [0039.597] GetProcessHeap () returned 0x560000 [0039.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584470 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a10 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e1d0 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584740 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0039.598] GetProcessHeap () returned 0x560000 [0039.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e2d8 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584350 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e2d8 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.599] GetProcessHeap () returned 0x560000 [0039.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.600] GetProcessHeap () returned 0x560000 [0039.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.601] GetProcessHeap () returned 0x560000 [0039.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.601] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.602] GetProcessHeap () returned 0x560000 [0039.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.602] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e1d0 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584470 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.603] GetProcessHeap () returned 0x560000 [0039.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.603] WriteFile (in: hFile=0x230, lpBuffer=0x56ec10*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ec10*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0039.608] GetProcessHeap () returned 0x560000 [0039.608] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ec10, Size=0x30) returned 0x56ec10 [0039.608] GetProcessHeap () returned 0x560000 [0039.608] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.608] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.608] GetProcessHeap () returned 0x560000 [0039.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf44d) returned 0x58eb28 [0039.609] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0xf44d, lpOverlapped=0x0) returned 1 [0039.610] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.610] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0xf44d, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0xf44d, lpOverlapped=0x0) returned 1 [0039.612] GetProcessHeap () returned 0x560000 [0039.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.612] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.612] WriteFile (in: hFile=0x230, lpBuffer=0x56ec10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ec10*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.613] CloseHandle (hObject=0x230) returned 1 [0039.615] GetProcessHeap () returned 0x560000 [0039.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0039.615] GetProcessHeap () returned 0x560000 [0039.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.615] GetProcessHeap () returned 0x560000 [0039.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.615] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0039.615] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm.badday" [0039.616] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.badday"), dwFlags=0x1) returned 1 [0039.616] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.616] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.616] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.616] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.616] GetProcessHeap () returned 0x560000 [0039.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.616] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0039.616] lstrcmpiW (lpString1="default_eos.css", lpString2=".") returned 1 [0039.616] lstrcmpiW (lpString1="default_eos.css", lpString2="..") returned 1 [0039.616] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0039.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.616] GetProcessHeap () returned 0x560000 [0039.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0039.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.css", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_eos.css", lpUsedDefaultChar=0x0) returned 16 [0039.616] lstrlenA (lpString="default_eos.css") returned 15 [0039.617] lstrlenA (lpString=".badday") returned 7 [0039.617] lstrlenA (lpString=".badday") returned 7 [0039.617] lstrlenA (lpString="default_eos.css") returned 15 [0039.617] lstrcmpiA (lpString1="eos.css", lpString2=".badday") returned 1 [0039.617] lstrcmpiW (lpString1="default_eos.css", lpString2="how_to_back_files.html") returned -1 [0039.617] lstrcmpiW (lpString1="default_eos.css", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.617] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.617] lstrcmpiW (lpString1="default_eos.css", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.617] GetProcessHeap () returned 0x560000 [0039.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0039.617] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.618] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=6700) returned 1 [0039.618] GetProcessHeap () returned 0x560000 [0039.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.618] GetProcessHeap () returned 0x560000 [0039.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.618] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned 48 [0039.618] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.618] GetProcessHeap () returned 0x560000 [0039.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.618] GetProcessHeap () returned 0x560000 [0039.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x56ec48 [0039.618] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.618] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.618] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.618] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.618] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.619] lstrlenA (lpString="010001") returned 6 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584fb0 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4b8 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5848f0 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0039.619] GetProcessHeap () returned 0x560000 [0039.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848f0 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4e8 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d70 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4e8 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.620] GetProcessHeap () returned 0x560000 [0039.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.621] GetProcessHeap () returned 0x560000 [0039.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.622] GetProcessHeap () returned 0x560000 [0039.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.622] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.623] GetProcessHeap () returned 0x560000 [0039.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.623] GetProcessHeap () returned 0x560000 [0039.624] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4b8 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fb0 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.624] GetProcessHeap () returned 0x560000 [0039.624] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.624] WriteFile (in: hFile=0x230, lpBuffer=0x56ec48*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ec48*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0039.627] GetProcessHeap () returned 0x560000 [0039.627] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ec48, Size=0x30) returned 0x56ec48 [0039.627] GetProcessHeap () returned 0x560000 [0039.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.627] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.627] GetProcessHeap () returned 0x560000 [0039.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a30) returned 0x58eb28 [0039.627] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x1a30, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x1a30, lpOverlapped=0x0) returned 1 [0039.628] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.628] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x1a30, lpOverlapped=0x0) returned 1 [0039.629] GetProcessHeap () returned 0x560000 [0039.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.629] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.629] WriteFile (in: hFile=0x230, lpBuffer=0x56ec48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ec48*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.641] CloseHandle (hObject=0x230) returned 1 [0039.643] GetProcessHeap () returned 0x560000 [0039.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0039.643] GetProcessHeap () returned 0x560000 [0039.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.643] GetProcessHeap () returned 0x560000 [0039.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.643] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0039.643] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.badday" [0039.643] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.badday"), dwFlags=0x1) returned 1 [0039.643] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.643] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.643] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.643] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.643] GetProcessHeap () returned 0x560000 [0039.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.643] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0039.643] lstrcmpiW (lpString1="default_eos.htm", lpString2=".") returned 1 [0039.644] lstrcmpiW (lpString1="default_eos.htm", lpString2="..") returned 1 [0039.644] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0039.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.644] GetProcessHeap () returned 0x560000 [0039.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0039.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_eos.htm", lpUsedDefaultChar=0x0) returned 16 [0039.644] lstrlenA (lpString="default_eos.htm") returned 15 [0039.644] lstrlenA (lpString=".badday") returned 7 [0039.644] lstrlenA (lpString=".badday") returned 7 [0039.644] lstrlenA (lpString="default_eos.htm") returned 15 [0039.644] lstrcmpiA (lpString1="eos.htm", lpString2=".badday") returned 1 [0039.644] lstrcmpiW (lpString1="default_eos.htm", lpString2="how_to_back_files.html") returned -1 [0039.644] lstrcmpiW (lpString1="default_eos.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.644] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.644] lstrcmpiW (lpString1="default_eos.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.644] GetProcessHeap () returned 0x560000 [0039.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0039.644] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.644] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=55866) returned 1 [0039.644] GetProcessHeap () returned 0x560000 [0039.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.644] GetProcessHeap () returned 0x560000 [0039.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.644] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned 48 [0039.645] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.645] GetProcessHeap () returned 0x560000 [0039.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.645] GetProcessHeap () returned 0x560000 [0039.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x56ec80 [0039.645] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.645] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.645] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.645] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.646] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.646] lstrlenA (lpString="010001") returned 6 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589fd8 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56f010 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584740 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f010 | out: hHeap=0x560000) returned 1 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f20 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56f010 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e170 [0039.646] GetProcessHeap () returned 0x560000 [0039.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584aa0 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f010 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e1e8 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d70 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e1e8 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.647] GetProcessHeap () returned 0x560000 [0039.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.647] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.648] GetProcessHeap () returned 0x560000 [0039.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.648] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.649] GetProcessHeap () returned 0x560000 [0039.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.649] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.650] GetProcessHeap () returned 0x560000 [0039.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e170 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f20 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.651] GetProcessHeap () returned 0x560000 [0039.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.652] GetProcessHeap () returned 0x560000 [0039.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.652] WriteFile (in: hFile=0x230, lpBuffer=0x56ec80*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ec80*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0039.654] GetProcessHeap () returned 0x560000 [0039.654] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ec80, Size=0x30) returned 0x56ec80 [0039.654] GetProcessHeap () returned 0x560000 [0039.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.655] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.655] GetProcessHeap () returned 0x560000 [0039.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xda40) returned 0x58eb28 [0039.655] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0xda40, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0xda40, lpOverlapped=0x0) returned 1 [0039.656] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.656] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0xda40, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0xda40, lpOverlapped=0x0) returned 1 [0039.685] GetProcessHeap () returned 0x560000 [0039.685] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.686] WriteFile (in: hFile=0x230, lpBuffer=0x56ec80*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ec80*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.687] CloseHandle (hObject=0x230) returned 1 [0039.689] GetProcessHeap () returned 0x560000 [0039.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0039.689] GetProcessHeap () returned 0x560000 [0039.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.689] GetProcessHeap () returned 0x560000 [0039.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.689] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0039.689] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.badday" [0039.689] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.badday"), dwFlags=0x1) returned 1 [0039.690] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.690] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.690] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.690] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.690] GetProcessHeap () returned 0x560000 [0039.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.690] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0039.690] lstrcmpiW (lpString1="default_oobe.css", lpString2=".") returned 1 [0039.690] lstrcmpiW (lpString1="default_oobe.css", lpString2="..") returned 1 [0039.690] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0039.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.690] GetProcessHeap () returned 0x560000 [0039.690] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576878 [0039.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.css", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_oobe.css", lpUsedDefaultChar=0x0) returned 17 [0039.690] lstrlenA (lpString="default_oobe.css") returned 16 [0039.690] lstrlenA (lpString=".badday") returned 7 [0039.690] lstrlenA (lpString=".badday") returned 7 [0039.690] lstrlenA (lpString="default_oobe.css") returned 16 [0039.690] lstrcmpiA (lpString1="obe.css", lpString2=".badday") returned 1 [0039.690] lstrcmpiW (lpString1="default_oobe.css", lpString2="how_to_back_files.html") returned -1 [0039.690] lstrcmpiW (lpString1="default_oobe.css", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.690] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.690] lstrcmpiW (lpString1="default_oobe.css", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.690] GetProcessHeap () returned 0x560000 [0039.690] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0039.690] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.691] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=5224) returned 1 [0039.691] GetProcessHeap () returned 0x560000 [0039.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.691] GetProcessHeap () returned 0x560000 [0039.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.691] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned 49 [0039.691] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.691] GetProcessHeap () returned 0x560000 [0039.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.691] GetProcessHeap () returned 0x560000 [0039.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56ecb8 [0039.691] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.691] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.692] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.692] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.692] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.692] lstrlenA (lpString="010001") returned 6 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ce0 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.692] GetProcessHeap () returned 0x560000 [0039.692] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5842c0 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e218 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584a10 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e218 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.693] GetProcessHeap () returned 0x560000 [0039.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.694] GetProcessHeap () returned 0x560000 [0039.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.694] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.695] GetProcessHeap () returned 0x560000 [0039.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.695] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.696] GetProcessHeap () returned 0x560000 [0039.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.696] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.697] GetProcessHeap () returned 0x560000 [0039.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.698] GetProcessHeap () returned 0x560000 [0039.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.698] GetProcessHeap () returned 0x560000 [0039.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.698] GetProcessHeap () returned 0x560000 [0039.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ce0 | out: hHeap=0x560000) returned 1 [0039.698] GetProcessHeap () returned 0x560000 [0039.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.698] GetProcessHeap () returned 0x560000 [0039.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.698] GetProcessHeap () returned 0x560000 [0039.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.698] WriteFile (in: hFile=0x230, lpBuffer=0x56ecb8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ecb8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0039.702] GetProcessHeap () returned 0x560000 [0039.702] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ecb8, Size=0x30) returned 0x56ecb8 [0039.702] GetProcessHeap () returned 0x560000 [0039.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.702] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.702] GetProcessHeap () returned 0x560000 [0039.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1470) returned 0x58eb28 [0039.702] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x1470, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x1470, lpOverlapped=0x0) returned 1 [0039.703] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.703] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x1470, lpOverlapped=0x0) returned 1 [0039.704] GetProcessHeap () returned 0x560000 [0039.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.704] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.704] WriteFile (in: hFile=0x230, lpBuffer=0x56ecb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ecb8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.705] CloseHandle (hObject=0x230) returned 1 [0039.706] GetProcessHeap () returned 0x560000 [0039.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0039.706] GetProcessHeap () returned 0x560000 [0039.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.706] GetProcessHeap () returned 0x560000 [0039.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.706] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0039.706] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.badday" [0039.706] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.badday"), dwFlags=0x1) returned 1 [0039.707] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.707] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.707] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.707] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.707] GetProcessHeap () returned 0x560000 [0039.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0039.707] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0039.707] lstrcmpiW (lpString1="default_oobe.htm", lpString2=".") returned 1 [0039.707] lstrcmpiW (lpString1="default_oobe.htm", lpString2="..") returned 1 [0039.707] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0039.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.707] GetProcessHeap () returned 0x560000 [0039.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x5767f8 [0039.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.htm", cchWideChar=-1, lpMultiByteStr=0x5767f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_oobe.htm", lpUsedDefaultChar=0x0) returned 17 [0039.707] lstrlenA (lpString="default_oobe.htm") returned 16 [0039.707] lstrlenA (lpString=".badday") returned 7 [0039.707] lstrlenA (lpString=".badday") returned 7 [0039.707] lstrlenA (lpString="default_oobe.htm") returned 16 [0039.707] lstrcmpiA (lpString1="obe.htm", lpString2=".badday") returned 1 [0039.707] lstrcmpiW (lpString1="default_oobe.htm", lpString2="how_to_back_files.html") returned -1 [0039.707] lstrcmpiW (lpString1="default_oobe.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.707] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.707] lstrcmpiW (lpString1="default_oobe.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.707] GetProcessHeap () returned 0x560000 [0039.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0039.707] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.708] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=65710) returned 1 [0039.708] GetProcessHeap () returned 0x560000 [0039.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.708] GetProcessHeap () returned 0x560000 [0039.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.708] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned 49 [0039.708] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.708] GetProcessHeap () returned 0x560000 [0039.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.708] GetProcessHeap () returned 0x560000 [0039.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x56ecf0 [0039.708] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.708] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.709] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.709] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.709] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.709] lstrlenA (lpString="010001") returned 6 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a10 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584740 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.709] GetProcessHeap () returned 0x560000 [0039.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584d70 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4b8 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d70 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4b8 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0039.710] GetProcessHeap () returned 0x560000 [0039.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.710] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.711] GetProcessHeap () returned 0x560000 [0039.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.712] GetProcessHeap () returned 0x560000 [0039.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.712] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.713] GetProcessHeap () returned 0x560000 [0039.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.713] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.714] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.715] GetProcessHeap () returned 0x560000 [0039.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.715] WriteFile (in: hFile=0x230, lpBuffer=0x56ecf0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ecf0*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0039.718] GetProcessHeap () returned 0x560000 [0039.718] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ecf0, Size=0x30) returned 0x56ecf0 [0039.718] GetProcessHeap () returned 0x560000 [0039.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.718] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.718] GetProcessHeap () returned 0x560000 [0039.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100b0) returned 0x58eb28 [0039.719] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x100b0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x100b0, lpOverlapped=0x0) returned 1 [0039.720] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.720] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x100b0, lpOverlapped=0x0) returned 1 [0039.722] GetProcessHeap () returned 0x560000 [0039.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.722] WriteFile (in: hFile=0x230, lpBuffer=0x56ecf0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ecf0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.723] CloseHandle (hObject=0x230) returned 1 [0039.743] GetProcessHeap () returned 0x560000 [0039.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0039.743] GetProcessHeap () returned 0x560000 [0039.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.743] GetProcessHeap () returned 0x560000 [0039.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.743] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0039.744] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.badday" [0039.744] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.badday"), dwFlags=0x1) returned 1 [0039.744] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.744] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.744] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.744] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.744] GetProcessHeap () returned 0x560000 [0039.744] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5767f8 | out: hHeap=0x560000) returned 1 [0039.744] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0039.744] lstrcmpiW (lpString1="EULA", lpString2=".") returned 1 [0039.744] lstrcmpiW (lpString1="EULA", lpString2="..") returned 1 [0039.744] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="EULA" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0039.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0039.744] GetProcessHeap () returned 0x560000 [0039.744] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x589fd8 [0039.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA", cchWideChar=-1, lpMultiByteStr=0x589fd8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA", lpUsedDefaultChar=0x0) returned 5 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0039.745] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0039.746] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0039.746] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0039.746] GetProcessHeap () returned 0x560000 [0039.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d8 [0039.746] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned 38 [0039.746] GetProcessHeap () returned 0x560000 [0039.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4e) returned 0x58b858 [0039.746] lstrcpyW (in: lpString1=0x58b858, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0039.746] GetProcessHeap () returned 0x560000 [0039.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.746] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eula.css", cAlternateFileName="")) returned 1 [0039.746] lstrcmpiW (lpString1="eula.css", lpString2=".") returned 1 [0039.746] lstrcmpiW (lpString1="eula.css", lpString2="..") returned 1 [0039.746] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0039.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eula.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.746] GetProcessHeap () returned 0x560000 [0039.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0039.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eula.css", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.css", lpUsedDefaultChar=0x0) returned 9 [0039.746] lstrlenA (lpString="eula.css") returned 8 [0039.746] lstrlenA (lpString=".badday") returned 7 [0039.746] lstrlenA (lpString=".badday") returned 7 [0039.746] lstrlenA (lpString="eula.css") returned 8 [0039.746] lstrcmpiA (lpString1="ula.css", lpString2=".badday") returned 1 [0039.747] lstrcmpiW (lpString1="eula.css", lpString2="how_to_back_files.html") returned -1 [0039.747] lstrcmpiW (lpString1="eula.css", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.747] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.747] lstrcmpiW (lpString1="eula.css", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.747] GetProcessHeap () returned 0x560000 [0039.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0039.747] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.747] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=82) returned 1 [0039.748] GetProcessHeap () returned 0x560000 [0039.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.748] GetProcessHeap () returned 0x560000 [0039.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.748] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned 41 [0039.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.748] GetProcessHeap () returned 0x560000 [0039.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.748] GetProcessHeap () returned 0x560000 [0039.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x56ed28 [0039.748] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.748] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.748] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.748] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.748] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.748] GetProcessHeap () returned 0x560000 [0039.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.748] lstrlenA (lpString="010001") returned 6 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584fb0 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584980 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589fd8 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e458 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f20 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f20 | out: hHeap=0x560000) returned 1 [0039.749] GetProcessHeap () returned 0x560000 [0039.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4b8 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5842c0 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4b8 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.750] GetProcessHeap () returned 0x560000 [0039.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.750] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.751] GetProcessHeap () returned 0x560000 [0039.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.751] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.752] GetProcessHeap () returned 0x560000 [0039.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.753] GetProcessHeap () returned 0x560000 [0039.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.753] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e458 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584980 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fb0 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.754] GetProcessHeap () returned 0x560000 [0039.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.754] WriteFile (in: hFile=0x230, lpBuffer=0x56ed28*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ed28*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0039.758] GetProcessHeap () returned 0x560000 [0039.758] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56ed28, Size=0x30) returned 0x56ed28 [0039.758] GetProcessHeap () returned 0x560000 [0039.758] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.759] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.759] GetProcessHeap () returned 0x560000 [0039.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x60) returned 0x572a40 [0039.759] ReadFile (in: hFile=0x230, lpBuffer=0x572a40, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x572a40*, lpNumberOfBytesRead=0x24ad7e8*=0x60, lpOverlapped=0x0) returned 1 [0039.759] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.759] WriteFile (in: hFile=0x230, lpBuffer=0x572a40*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x572a40*, lpNumberOfBytesWritten=0x24ad7e4*=0x60, lpOverlapped=0x0) returned 1 [0039.760] GetProcessHeap () returned 0x560000 [0039.760] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0039.760] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.760] WriteFile (in: hFile=0x230, lpBuffer=0x56ed28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56ed28*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.761] CloseHandle (hObject=0x230) returned 1 [0039.761] GetProcessHeap () returned 0x560000 [0039.761] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0039.761] GetProcessHeap () returned 0x560000 [0039.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.762] GetProcessHeap () returned 0x560000 [0039.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.762] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0039.762] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css.badday" [0039.762] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.badday"), dwFlags=0x1) returned 1 [0039.762] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.762] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.762] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.762] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.762] GetProcessHeap () returned 0x560000 [0039.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.762] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0039.762] lstrcmpiW (lpString1="GetStarted.png", lpString2=".") returned 1 [0039.762] lstrcmpiW (lpString1="GetStarted.png", lpString2="..") returned 1 [0039.762] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0039.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStarted.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0039.762] GetProcessHeap () returned 0x560000 [0039.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0039.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStarted.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetStarted.png", lpUsedDefaultChar=0x0) returned 15 [0039.763] lstrlenA (lpString="GetStarted.png") returned 14 [0039.763] lstrlenA (lpString=".badday") returned 7 [0039.763] lstrlenA (lpString=".badday") returned 7 [0039.763] lstrlenA (lpString="GetStarted.png") returned 14 [0039.763] lstrcmpiA (lpString1="ted.png", lpString2=".badday") returned 1 [0039.763] lstrcmpiW (lpString1="GetStarted.png", lpString2="how_to_back_files.html") returned -1 [0039.763] lstrcmpiW (lpString1="GetStarted.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.763] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.763] lstrcmpiW (lpString1="GetStarted.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.763] GetProcessHeap () returned 0x560000 [0039.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0039.763] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.763] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=3824) returned 1 [0039.763] GetProcessHeap () returned 0x560000 [0039.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.763] GetProcessHeap () returned 0x560000 [0039.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.763] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned 47 [0039.763] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.763] GetProcessHeap () returned 0x560000 [0039.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.763] GetProcessHeap () returned 0x560000 [0039.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58a708 [0039.764] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.764] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.764] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.764] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.764] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.764] GetProcessHeap () returned 0x560000 [0039.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.764] lstrlenA (lpString="010001") returned 6 [0039.764] GetProcessHeap () returned 0x560000 [0039.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0039.764] GetProcessHeap () returned 0x560000 [0039.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.764] GetProcessHeap () returned 0x560000 [0039.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0039.764] GetProcessHeap () returned 0x560000 [0039.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.764] GetProcessHeap () returned 0x560000 [0039.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ce0 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e200 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5847d0 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847d0 | out: hHeap=0x560000) returned 1 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e140 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.765] GetProcessHeap () returned 0x560000 [0039.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584f20 [0039.765] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e140 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f20 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.766] GetProcessHeap () returned 0x560000 [0039.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.767] GetProcessHeap () returned 0x560000 [0039.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.767] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.768] GetProcessHeap () returned 0x560000 [0039.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.769] GetProcessHeap () returned 0x560000 [0039.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e200 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ce0 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.770] GetProcessHeap () returned 0x560000 [0039.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.770] WriteFile (in: hFile=0x230, lpBuffer=0x58a708*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a708*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0039.776] GetProcessHeap () returned 0x560000 [0039.776] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a708, Size=0x30) returned 0x58a708 [0039.776] GetProcessHeap () returned 0x560000 [0039.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.776] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.776] GetProcessHeap () returned 0x560000 [0039.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xef0) returned 0x58eb28 [0039.776] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0xef0, lpOverlapped=0x0) returned 1 [0039.776] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.776] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0xef0, lpOverlapped=0x0) returned 1 [0039.777] GetProcessHeap () returned 0x560000 [0039.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.777] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.777] WriteFile (in: hFile=0x230, lpBuffer=0x58a708*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a708*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.778] CloseHandle (hObject=0x230) returned 1 [0039.779] GetProcessHeap () returned 0x560000 [0039.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0039.779] GetProcessHeap () returned 0x560000 [0039.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.779] GetProcessHeap () returned 0x560000 [0039.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.779] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0039.779] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.badday" [0039.779] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.badday"), dwFlags=0x1) returned 1 [0039.779] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.779] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.779] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.779] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.780] GetProcessHeap () returned 0x560000 [0039.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.780] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0039.780] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2=".") returned 1 [0039.780] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="..") returned 1 [0039.780] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0039.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStartedHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0039.780] GetProcessHeap () returned 0x560000 [0039.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576818 [0039.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStartedHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x576818, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetStartedHoverOver.png", lpUsedDefaultChar=0x0) returned 24 [0039.780] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0039.780] lstrlenA (lpString=".badday") returned 7 [0039.780] lstrlenA (lpString=".badday") returned 7 [0039.780] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0039.780] lstrcmpiA (lpString1="ver.png", lpString2=".badday") returned 1 [0039.780] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="how_to_back_files.html") returned -1 [0039.780] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.780] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.780] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.780] GetProcessHeap () returned 0x560000 [0039.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0039.780] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.781] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=4067) returned 1 [0039.781] GetProcessHeap () returned 0x560000 [0039.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.781] GetProcessHeap () returned 0x560000 [0039.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.781] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned 56 [0039.781] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.781] GetProcessHeap () returned 0x560000 [0039.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.781] GetProcessHeap () returned 0x560000 [0039.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58a740 [0039.781] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.781] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.781] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.781] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.781] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.781] GetProcessHeap () returned 0x560000 [0039.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.782] lstrlenA (lpString="010001") returned 6 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584b30 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584bc0 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.782] GetProcessHeap () returned 0x560000 [0039.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0039.782] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e368 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584e90 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e368 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.783] GetProcessHeap () returned 0x560000 [0039.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.784] GetProcessHeap () returned 0x560000 [0039.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.784] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.785] GetProcessHeap () returned 0x560000 [0039.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.786] GetProcessHeap () returned 0x560000 [0039.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.787] GetProcessHeap () returned 0x560000 [0039.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b30 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.788] GetProcessHeap () returned 0x560000 [0039.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.788] WriteFile (in: hFile=0x230, lpBuffer=0x58a740*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a740*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0039.791] GetProcessHeap () returned 0x560000 [0039.791] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a740, Size=0x30) returned 0x58a740 [0039.791] GetProcessHeap () returned 0x560000 [0039.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.791] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.791] GetProcessHeap () returned 0x560000 [0039.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xff0) returned 0x58eb28 [0039.791] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0xff0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0xff0, lpOverlapped=0x0) returned 1 [0039.792] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.792] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0xff0, lpOverlapped=0x0) returned 1 [0039.793] GetProcessHeap () returned 0x560000 [0039.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.793] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.793] WriteFile (in: hFile=0x230, lpBuffer=0x58a740*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a740*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.793] CloseHandle (hObject=0x230) returned 1 [0039.794] GetProcessHeap () returned 0x560000 [0039.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0039.795] GetProcessHeap () returned 0x560000 [0039.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.795] GetProcessHeap () returned 0x560000 [0039.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.795] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0039.795] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.badday" [0039.795] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.badday"), dwFlags=0x1) returned 1 [0039.795] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.795] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.795] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.795] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.795] GetProcessHeap () returned 0x560000 [0039.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576818 | out: hHeap=0x560000) returned 1 [0039.795] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0039.795] lstrcmpiW (lpString1="loading.gif", lpString2=".") returned 1 [0039.795] lstrcmpiW (lpString1="loading.gif", lpString2="..") returned 1 [0039.796] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0039.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loading.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.796] GetProcessHeap () returned 0x560000 [0039.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0039.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loading.gif", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loading.gif", lpUsedDefaultChar=0x0) returned 12 [0039.796] lstrlenA (lpString="loading.gif") returned 11 [0039.796] lstrlenA (lpString=".badday") returned 7 [0039.796] lstrlenA (lpString=".badday") returned 7 [0039.796] lstrlenA (lpString="loading.gif") returned 11 [0039.796] lstrcmpiA (lpString1="ing.gif", lpString2=".badday") returned 1 [0039.796] lstrcmpiW (lpString1="loading.gif", lpString2="how_to_back_files.html") returned 1 [0039.796] lstrcmpiW (lpString1="loading.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.796] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.796] lstrcmpiW (lpString1="loading.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.796] GetProcessHeap () returned 0x560000 [0039.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0039.796] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.796] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=17395) returned 1 [0039.796] GetProcessHeap () returned 0x560000 [0039.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.796] GetProcessHeap () returned 0x560000 [0039.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.796] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned 44 [0039.796] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.796] GetProcessHeap () returned 0x560000 [0039.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.797] GetProcessHeap () returned 0x560000 [0039.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58a778 [0039.797] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.797] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.797] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.797] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.797] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.797] GetProcessHeap () returned 0x560000 [0039.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.797] lstrlenA (lpString="010001") returned 6 [0039.797] GetProcessHeap () returned 0x560000 [0039.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0039.797] GetProcessHeap () returned 0x560000 [0039.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.797] GetProcessHeap () returned 0x560000 [0039.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.797] GetProcessHeap () returned 0x560000 [0039.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584620 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e128 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5850d0 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850d0 | out: hHeap=0x560000) returned 1 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e368 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.798] GetProcessHeap () returned 0x560000 [0039.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5851f0 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e368 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851f0 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.799] GetProcessHeap () returned 0x560000 [0039.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.800] GetProcessHeap () returned 0x560000 [0039.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.800] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.801] GetProcessHeap () returned 0x560000 [0039.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.801] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.802] GetProcessHeap () returned 0x560000 [0039.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e128 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584620 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.803] GetProcessHeap () returned 0x560000 [0039.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.803] WriteFile (in: hFile=0x230, lpBuffer=0x58a778*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a778*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0039.807] GetProcessHeap () returned 0x560000 [0039.807] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a778, Size=0x30) returned 0x58a778 [0039.807] GetProcessHeap () returned 0x560000 [0039.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.807] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.807] GetProcessHeap () returned 0x560000 [0039.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4400) returned 0x58eb28 [0039.807] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x4400, lpOverlapped=0x0) returned 1 [0039.808] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.808] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x4400, lpOverlapped=0x0) returned 1 [0039.809] GetProcessHeap () returned 0x560000 [0039.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.809] WriteFile (in: hFile=0x230, lpBuffer=0x58a778*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a778*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.810] CloseHandle (hObject=0x230) returned 1 [0039.811] GetProcessHeap () returned 0x560000 [0039.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0039.811] GetProcessHeap () returned 0x560000 [0039.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.811] GetProcessHeap () returned 0x560000 [0039.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.811] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0039.811] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.badday" [0039.812] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.badday"), dwFlags=0x1) returned 1 [0039.812] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.812] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.812] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.812] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.812] GetProcessHeap () returned 0x560000 [0039.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.812] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lock.png", cAlternateFileName="")) returned 1 [0039.812] lstrcmpiW (lpString1="lock.png", lpString2=".") returned 1 [0039.812] lstrcmpiW (lpString1="lock.png", lpString2="..") returned 1 [0039.812] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="lock.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0039.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lock.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.812] GetProcessHeap () returned 0x560000 [0039.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0039.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lock.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lock.png", lpUsedDefaultChar=0x0) returned 9 [0039.812] lstrlenA (lpString="lock.png") returned 8 [0039.813] lstrlenA (lpString=".badday") returned 7 [0039.813] lstrlenA (lpString=".badday") returned 7 [0039.813] lstrlenA (lpString="lock.png") returned 8 [0039.813] lstrcmpiA (lpString1="ock.png", lpString2=".badday") returned 1 [0039.813] lstrcmpiW (lpString1="lock.png", lpString2="how_to_back_files.html") returned 1 [0039.813] lstrcmpiW (lpString1="lock.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.813] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.813] lstrcmpiW (lpString1="lock.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.813] GetProcessHeap () returned 0x560000 [0039.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0039.813] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.814] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=3677) returned 1 [0039.814] GetProcessHeap () returned 0x560000 [0039.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.814] GetProcessHeap () returned 0x560000 [0039.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.814] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned 41 [0039.814] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.814] GetProcessHeap () returned 0x560000 [0039.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.814] GetProcessHeap () returned 0x560000 [0039.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x58a7b0 [0039.814] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.814] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.815] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.815] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.815] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.816] lstrlenA (lpString="010001") returned 6 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846b0 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5851f0 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e440 [0039.816] GetProcessHeap () returned 0x560000 [0039.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e90 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e428 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585040 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e428 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.817] GetProcessHeap () returned 0x560000 [0039.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.817] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.818] GetProcessHeap () returned 0x560000 [0039.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.819] GetProcessHeap () returned 0x560000 [0039.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.819] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.820] GetProcessHeap () returned 0x560000 [0039.820] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.820] GetProcessHeap () returned 0x560000 [0039.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e440 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851f0 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.821] GetProcessHeap () returned 0x560000 [0039.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0039.822] GetProcessHeap () returned 0x560000 [0039.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.822] GetProcessHeap () returned 0x560000 [0039.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.822] GetProcessHeap () returned 0x560000 [0039.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.822] WriteFile (in: hFile=0x230, lpBuffer=0x58a7b0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a7b0*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0039.825] GetProcessHeap () returned 0x560000 [0039.825] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a7b0, Size=0x30) returned 0x58a7b0 [0039.825] GetProcessHeap () returned 0x560000 [0039.825] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.825] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.825] GetProcessHeap () returned 0x560000 [0039.825] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe60) returned 0x58eb28 [0039.825] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0xe60, lpOverlapped=0x0) returned 1 [0039.825] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.825] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0xe60, lpOverlapped=0x0) returned 1 [0039.826] GetProcessHeap () returned 0x560000 [0039.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.826] WriteFile (in: hFile=0x230, lpBuffer=0x58a7b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a7b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.827] CloseHandle (hObject=0x230) returned 1 [0039.828] GetProcessHeap () returned 0x560000 [0039.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0039.828] GetProcessHeap () returned 0x560000 [0039.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.828] GetProcessHeap () returned 0x560000 [0039.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.828] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0039.828] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png.badday" [0039.828] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.badday"), dwFlags=0x1) returned 1 [0039.829] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.829] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.829] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.829] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.829] GetProcessHeap () returned 0x560000 [0039.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.829] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0039.829] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0039.829] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0039.829] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0039.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.829] GetProcessHeap () returned 0x560000 [0039.829] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0039.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 9 [0039.829] lstrlenA (lpString="logo.png") returned 8 [0039.829] lstrlenA (lpString=".badday") returned 7 [0039.829] lstrlenA (lpString=".badday") returned 7 [0039.829] lstrlenA (lpString="logo.png") returned 8 [0039.829] lstrcmpiA (lpString1="ogo.png", lpString2=".badday") returned 1 [0039.829] lstrcmpiW (lpString1="logo.png", lpString2="how_to_back_files.html") returned 1 [0039.829] lstrcmpiW (lpString1="logo.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.829] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.829] lstrcmpiW (lpString1="logo.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0039.829] GetProcessHeap () returned 0x560000 [0039.829] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0039.829] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.830] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2611) returned 1 [0039.830] GetProcessHeap () returned 0x560000 [0039.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.830] GetProcessHeap () returned 0x560000 [0039.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.830] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned 41 [0039.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.830] GetProcessHeap () returned 0x560000 [0039.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.830] GetProcessHeap () returned 0x560000 [0039.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58a7e8 [0039.830] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.830] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.830] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.831] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.831] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.831] lstrlenA (lpString="010001") returned 6 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589fd8 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584fb0 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e3b0 [0039.831] GetProcessHeap () returned 0x560000 [0039.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e290 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584e00 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e290 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.832] GetProcessHeap () returned 0x560000 [0039.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.832] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.833] GetProcessHeap () returned 0x560000 [0039.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.834] GetProcessHeap () returned 0x560000 [0039.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.835] GetProcessHeap () returned 0x560000 [0039.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e3b0 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fb0 | out: hHeap=0x560000) returned 1 [0039.836] GetProcessHeap () returned 0x560000 [0039.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.837] GetProcessHeap () returned 0x560000 [0039.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0039.837] GetProcessHeap () returned 0x560000 [0039.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.837] GetProcessHeap () returned 0x560000 [0039.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.837] GetProcessHeap () returned 0x560000 [0039.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.837] WriteFile (in: hFile=0x230, lpBuffer=0x58a7e8*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a7e8*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0039.840] GetProcessHeap () returned 0x560000 [0039.840] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a7e8, Size=0x30) returned 0x58a7e8 [0039.840] GetProcessHeap () returned 0x560000 [0039.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.840] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.840] GetProcessHeap () returned 0x560000 [0039.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa40) returned 0x58eb28 [0039.840] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0xa40, lpOverlapped=0x0) returned 1 [0039.840] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.840] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0xa40, lpOverlapped=0x0) returned 1 [0039.841] GetProcessHeap () returned 0x560000 [0039.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.841] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.841] WriteFile (in: hFile=0x230, lpBuffer=0x58a7e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a7e8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.842] CloseHandle (hObject=0x230) returned 1 [0039.843] GetProcessHeap () returned 0x560000 [0039.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0039.843] GetProcessHeap () returned 0x560000 [0039.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.843] GetProcessHeap () returned 0x560000 [0039.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.843] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0039.843] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png.badday" [0039.843] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.badday"), dwFlags=0x1) returned 1 [0039.844] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.844] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.844] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.844] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.844] GetProcessHeap () returned 0x560000 [0039.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.844] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0039.844] lstrcmpiW (lpString1="marketing.png", lpString2=".") returned 1 [0039.844] lstrcmpiW (lpString1="marketing.png", lpString2="..") returned 1 [0039.844] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0039.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="marketing.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.844] GetProcessHeap () returned 0x560000 [0039.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0039.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="marketing.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="marketing.png", lpUsedDefaultChar=0x0) returned 14 [0039.844] lstrlenA (lpString="marketing.png") returned 13 [0039.844] lstrlenA (lpString=".badday") returned 7 [0039.844] lstrlenA (lpString=".badday") returned 7 [0039.844] lstrlenA (lpString="marketing.png") returned 13 [0039.844] lstrcmpiA (lpString1="ing.png", lpString2=".badday") returned 1 [0039.844] lstrcmpiW (lpString1="marketing.png", lpString2="how_to_back_files.html") returned 1 [0039.844] lstrcmpiW (lpString1="marketing.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.844] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.844] lstrcmpiW (lpString1="marketing.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.844] GetProcessHeap () returned 0x560000 [0039.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0039.844] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.845] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=493) returned 1 [0039.845] GetProcessHeap () returned 0x560000 [0039.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.845] GetProcessHeap () returned 0x560000 [0039.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.845] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned 46 [0039.845] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.845] GetProcessHeap () returned 0x560000 [0039.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.845] GetProcessHeap () returned 0x560000 [0039.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x58a820 [0039.845] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.845] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.846] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.846] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.846] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.846] lstrlenA (lpString="010001") returned 6 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584aa0 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5850d0 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0039.846] GetProcessHeap () returned 0x560000 [0039.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e248 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a10 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e410 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585160 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e410 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585160 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0039.847] GetProcessHeap () returned 0x560000 [0039.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.848] GetProcessHeap () returned 0x560000 [0039.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.849] GetProcessHeap () returned 0x560000 [0039.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.850] GetProcessHeap () returned 0x560000 [0039.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0039.850] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.851] GetProcessHeap () returned 0x560000 [0039.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.851] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e248 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850d0 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584aa0 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.852] GetProcessHeap () returned 0x560000 [0039.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.852] WriteFile (in: hFile=0x230, lpBuffer=0x58a820*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a820*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0039.855] GetProcessHeap () returned 0x560000 [0039.855] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a820, Size=0x30) returned 0x58a820 [0039.855] GetProcessHeap () returned 0x560000 [0039.855] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.856] GetProcessHeap () returned 0x560000 [0039.856] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1f0) returned 0x5852a0 [0039.856] ReadFile (in: hFile=0x230, lpBuffer=0x5852a0, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5852a0*, lpNumberOfBytesRead=0x24ad7e8*=0x1f0, lpOverlapped=0x0) returned 1 [0039.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.856] WriteFile (in: hFile=0x230, lpBuffer=0x5852a0*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5852a0*, lpNumberOfBytesWritten=0x24ad7e4*=0x1f0, lpOverlapped=0x0) returned 1 [0039.857] GetProcessHeap () returned 0x560000 [0039.857] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5852a0 | out: hHeap=0x560000) returned 1 [0039.857] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.857] WriteFile (in: hFile=0x230, lpBuffer=0x58a820*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a820*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.858] CloseHandle (hObject=0x230) returned 1 [0039.858] GetProcessHeap () returned 0x560000 [0039.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0039.859] GetProcessHeap () returned 0x560000 [0039.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.859] GetProcessHeap () returned 0x560000 [0039.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.859] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0039.859] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.badday" [0039.859] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.badday"), dwFlags=0x1) returned 1 [0039.859] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.859] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.859] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.859] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.859] GetProcessHeap () returned 0x560000 [0039.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.859] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0039.859] lstrcmpiW (lpString1="Microsoft.WinJS", lpString2=".") returned 1 [0039.859] lstrcmpiW (lpString1="Microsoft.WinJS", lpString2="..") returned 1 [0039.859] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Microsoft.WinJS" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0039.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft.WinJS", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.860] GetProcessHeap () returned 0x560000 [0039.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0039.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft.WinJS", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.WinJS", lpUsedDefaultChar=0x0) returned 16 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0039.860] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0039.861] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0039.861] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0039.861] GetProcessHeap () returned 0x560000 [0039.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a138 [0039.861] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned 49 [0039.861] GetProcessHeap () returned 0x560000 [0039.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x64) returned 0x566e98 [0039.861] lstrcpyW (in: lpString1=0x566e98, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0039.861] GetProcessHeap () returned 0x560000 [0039.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.861] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0039.861] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2=".") returned 1 [0039.861] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="..") returned 1 [0039.861] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NetworkIssueFAQ.mht" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0039.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetworkIssueFAQ.mht", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0039.861] GetProcessHeap () returned 0x560000 [0039.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5769f8 [0039.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetworkIssueFAQ.mht", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetworkIssueFAQ.mht", lpUsedDefaultChar=0x0) returned 20 [0039.862] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0039.862] lstrlenA (lpString=".badday") returned 7 [0039.862] lstrlenA (lpString=".badday") returned 7 [0039.862] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0039.862] lstrcmpiA (lpString1="FAQ.mht", lpString2=".badday") returned 1 [0039.862] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="how_to_back_files.html") returned 1 [0039.862] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.862] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.862] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.862] GetProcessHeap () returned 0x560000 [0039.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0039.862] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.863] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=622093) returned 1 [0039.863] GetProcessHeap () returned 0x560000 [0039.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.863] GetProcessHeap () returned 0x560000 [0039.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.864] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned 52 [0039.864] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.864] GetProcessHeap () returned 0x560000 [0039.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.864] GetProcessHeap () returned 0x560000 [0039.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58a858 [0039.864] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.864] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.864] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.864] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.864] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.865] lstrlenA (lpString="010001") returned 6 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584d70 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586ec0 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e90 [0039.865] GetProcessHeap () returned 0x560000 [0039.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e278 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584470 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e278 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584470 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.866] GetProcessHeap () returned 0x560000 [0039.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.867] GetProcessHeap () returned 0x560000 [0039.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.868] GetProcessHeap () returned 0x560000 [0039.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.869] GetProcessHeap () returned 0x560000 [0039.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.869] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.870] GetProcessHeap () returned 0x560000 [0039.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.870] WriteFile (in: hFile=0x230, lpBuffer=0x58a858*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a858*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0039.874] GetProcessHeap () returned 0x560000 [0039.874] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a858, Size=0x30) returned 0x58a858 [0039.874] GetProcessHeap () returned 0x560000 [0039.874] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.874] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.874] GetProcessHeap () returned 0x560000 [0039.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x97e0d) returned 0x24be020 [0039.884] ReadFile (in: hFile=0x230, lpBuffer=0x24be020, nNumberOfBytesToRead=0x97e0d, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24be020*, lpNumberOfBytesRead=0x24ad7e8*=0x97e0d, lpOverlapped=0x0) returned 1 [0039.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.893] WriteFile (in: hFile=0x230, lpBuffer=0x24be020*, nNumberOfBytesToWrite=0x97e0d, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24be020*, lpNumberOfBytesWritten=0x24ad7e4*=0x97e0d, lpOverlapped=0x0) returned 1 [0039.941] GetProcessHeap () returned 0x560000 [0039.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24be020 | out: hHeap=0x560000) returned 1 [0039.944] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.944] WriteFile (in: hFile=0x230, lpBuffer=0x58a858*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a858*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.945] CloseHandle (hObject=0x230) returned 1 [0039.955] GetProcessHeap () returned 0x560000 [0039.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0039.955] GetProcessHeap () returned 0x560000 [0039.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.955] GetProcessHeap () returned 0x560000 [0039.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.955] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0039.955] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.badday" [0039.955] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.badday"), dwFlags=0x1) returned 1 [0039.956] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.956] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.956] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.956] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.956] GetProcessHeap () returned 0x560000 [0039.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0039.956] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0039.956] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2=".") returned 1 [0039.956] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="..") returned 1 [0039.956] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0039.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnection.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0039.956] GetProcessHeap () returned 0x560000 [0039.956] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576838 [0039.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnection.png", cchWideChar=-1, lpMultiByteStr=0x576838, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NoNetworkConnection.png", lpUsedDefaultChar=0x0) returned 24 [0039.956] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0039.956] lstrlenA (lpString=".badday") returned 7 [0039.956] lstrlenA (lpString=".badday") returned 7 [0039.956] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0039.956] lstrcmpiA (lpString1="ion.png", lpString2=".badday") returned 1 [0039.956] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="how_to_back_files.html") returned 1 [0039.956] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.956] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.957] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.957] GetProcessHeap () returned 0x560000 [0039.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0039.957] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.957] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2165) returned 1 [0039.957] GetProcessHeap () returned 0x560000 [0039.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.957] GetProcessHeap () returned 0x560000 [0039.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.957] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned 56 [0039.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.957] GetProcessHeap () returned 0x560000 [0039.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.957] GetProcessHeap () returned 0x560000 [0039.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x58a890 [0039.957] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.957] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.958] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.958] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.958] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.958] GetProcessHeap () returned 0x560000 [0039.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.958] lstrlenA (lpString="010001") returned 6 [0039.958] GetProcessHeap () returned 0x560000 [0039.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0039.958] GetProcessHeap () returned 0x560000 [0039.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.958] GetProcessHeap () returned 0x560000 [0039.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5842c0 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4d0 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.959] GetProcessHeap () returned 0x560000 [0039.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584bc0 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4d0 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bc0 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.960] GetProcessHeap () returned 0x560000 [0039.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.961] GetProcessHeap () returned 0x560000 [0039.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.962] GetProcessHeap () returned 0x560000 [0039.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.962] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.963] GetProcessHeap () returned 0x560000 [0039.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.963] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.964] GetProcessHeap () returned 0x560000 [0039.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.964] WriteFile (in: hFile=0x230, lpBuffer=0x58a890*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a890*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0039.968] GetProcessHeap () returned 0x560000 [0039.968] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a890, Size=0x30) returned 0x58a890 [0039.968] GetProcessHeap () returned 0x560000 [0039.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.968] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.968] GetProcessHeap () returned 0x560000 [0039.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x880) returned 0x58eb28 [0039.969] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x880, lpOverlapped=0x0) returned 1 [0039.969] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.969] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x880, lpOverlapped=0x0) returned 1 [0039.970] GetProcessHeap () returned 0x560000 [0039.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.970] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.970] WriteFile (in: hFile=0x230, lpBuffer=0x58a890*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a890*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.971] CloseHandle (hObject=0x230) returned 1 [0039.973] GetProcessHeap () returned 0x560000 [0039.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0039.973] GetProcessHeap () returned 0x560000 [0039.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.973] GetProcessHeap () returned 0x560000 [0039.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.973] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0039.973] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.badday" [0039.973] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.badday"), dwFlags=0x1) returned 1 [0039.973] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.973] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.973] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.974] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.974] GetProcessHeap () returned 0x560000 [0039.974] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576838 | out: hHeap=0x560000) returned 1 [0039.974] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0039.974] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2=".") returned 1 [0039.974] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="..") returned 1 [0039.974] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0039.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnectionHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0039.974] GetProcessHeap () returned 0x560000 [0039.974] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x21) returned 0x5758a0 [0039.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnectionHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x5758a0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NoNetworkConnectionHoverOver.png", lpUsedDefaultChar=0x0) returned 33 [0039.974] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0039.974] lstrlenA (lpString=".badday") returned 7 [0039.974] lstrlenA (lpString=".badday") returned 7 [0039.974] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0039.974] lstrcmpiA (lpString1="ver.png", lpString2=".badday") returned 1 [0039.974] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="how_to_back_files.html") returned 1 [0039.974] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.974] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.974] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.974] GetProcessHeap () returned 0x560000 [0039.974] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d490 [0039.974] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.975] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2212) returned 1 [0039.975] GetProcessHeap () returned 0x560000 [0039.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.975] GetProcessHeap () returned 0x560000 [0039.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.975] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned 65 [0039.975] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.975] GetProcessHeap () returned 0x560000 [0039.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.975] GetProcessHeap () returned 0x560000 [0039.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x58a8c8 [0039.975] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.975] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.975] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.975] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.975] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.975] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.976] lstrlenA (lpString="010001") returned 6 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5847d0 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584740 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f20 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.976] GetProcessHeap () returned 0x560000 [0039.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0039.976] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f20 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4d0 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584350 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4d0 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.977] GetProcessHeap () returned 0x560000 [0039.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.978] GetProcessHeap () returned 0x560000 [0039.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.979] GetProcessHeap () returned 0x560000 [0039.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.979] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.980] GetProcessHeap () returned 0x560000 [0039.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.980] GetProcessHeap () returned 0x560000 [0039.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847d0 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.981] GetProcessHeap () returned 0x560000 [0039.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.981] WriteFile (in: hFile=0x230, lpBuffer=0x58a8c8*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a8c8*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0039.984] GetProcessHeap () returned 0x560000 [0039.984] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a8c8, Size=0x30) returned 0x58a8c8 [0039.984] GetProcessHeap () returned 0x560000 [0039.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0039.984] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.984] GetProcessHeap () returned 0x560000 [0039.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8b0) returned 0x58eb28 [0039.984] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x8b0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x8b0, lpOverlapped=0x0) returned 1 [0039.984] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0039.984] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x8b0, lpOverlapped=0x0) returned 1 [0039.985] GetProcessHeap () returned 0x560000 [0039.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0039.985] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.985] WriteFile (in: hFile=0x230, lpBuffer=0x58a8c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a8c8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0039.986] CloseHandle (hObject=0x230) returned 1 [0039.987] GetProcessHeap () returned 0x560000 [0039.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d490 | out: hHeap=0x560000) returned 1 [0039.987] GetProcessHeap () returned 0x560000 [0039.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0039.987] GetProcessHeap () returned 0x560000 [0039.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0039.988] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0039.988] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.badday" [0039.988] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.badday"), dwFlags=0x1) returned 1 [0039.988] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0039.988] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0039.988] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0039.988] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0039.988] GetProcessHeap () returned 0x560000 [0039.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5758a0 | out: hHeap=0x560000) returned 1 [0039.988] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 1 [0039.988] lstrcmpiW (lpString1="pass.png", lpString2=".") returned 1 [0039.988] lstrcmpiW (lpString1="pass.png", lpString2="..") returned 1 [0039.989] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0039.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pass.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.989] GetProcessHeap () returned 0x560000 [0039.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0039.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pass.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pass.png", lpUsedDefaultChar=0x0) returned 9 [0039.989] lstrlenA (lpString="pass.png") returned 8 [0039.989] lstrlenA (lpString=".badday") returned 7 [0039.989] lstrlenA (lpString=".badday") returned 7 [0039.989] lstrlenA (lpString="pass.png") returned 8 [0039.989] lstrcmpiA (lpString1="ass.png", lpString2=".badday") returned 1 [0039.989] lstrcmpiW (lpString1="pass.png", lpString2="how_to_back_files.html") returned 1 [0039.989] lstrcmpiW (lpString1="pass.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0039.989] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0039.989] lstrcmpiW (lpString1="pass.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0039.989] GetProcessHeap () returned 0x560000 [0039.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d490 [0039.989] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0039.990] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1822) returned 1 [0039.990] GetProcessHeap () returned 0x560000 [0039.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0039.990] GetProcessHeap () returned 0x560000 [0039.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0039.990] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned 41 [0039.990] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0039.990] GetProcessHeap () returned 0x560000 [0039.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0039.990] GetProcessHeap () returned 0x560000 [0039.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x58a900 [0039.990] lstrlenA (lpString="rsa_encrypt") returned 11 [0039.990] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0039.991] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0039.991] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0039.991] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0039.991] lstrlenA (lpString="010001") returned 6 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e90 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.991] GetProcessHeap () returned 0x560000 [0039.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e428 [0039.991] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584500 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4a0 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584fb0 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4a0 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fb0 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.992] GetProcessHeap () returned 0x560000 [0039.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.992] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.993] GetProcessHeap () returned 0x560000 [0039.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.993] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0039.994] GetProcessHeap () returned 0x560000 [0039.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0039.994] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0039.995] GetProcessHeap () returned 0x560000 [0039.995] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e428 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0039.996] GetProcessHeap () returned 0x560000 [0039.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0039.997] GetProcessHeap () returned 0x560000 [0039.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0039.997] GetProcessHeap () returned 0x560000 [0039.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0039.997] WriteFile (in: hFile=0x230, lpBuffer=0x58a900*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a900*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0039.999] GetProcessHeap () returned 0x560000 [0040.000] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a900, Size=0x30) returned 0x58a900 [0040.000] GetProcessHeap () returned 0x560000 [0040.000] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.000] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.000] GetProcessHeap () returned 0x560000 [0040.000] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x720) returned 0x58eb28 [0040.000] ReadFile (in: hFile=0x230, lpBuffer=0x58eb28, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesRead=0x24ad7e8*=0x720, lpOverlapped=0x0) returned 1 [0040.000] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.000] WriteFile (in: hFile=0x230, lpBuffer=0x58eb28*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58eb28*, lpNumberOfBytesWritten=0x24ad7e4*=0x720, lpOverlapped=0x0) returned 1 [0040.001] GetProcessHeap () returned 0x560000 [0040.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58eb28 | out: hHeap=0x560000) returned 1 [0040.001] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.001] WriteFile (in: hFile=0x230, lpBuffer=0x58a900*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a900*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.002] CloseHandle (hObject=0x230) returned 1 [0040.003] GetProcessHeap () returned 0x560000 [0040.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d490 | out: hHeap=0x560000) returned 1 [0040.003] GetProcessHeap () returned 0x560000 [0040.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.003] GetProcessHeap () returned 0x560000 [0040.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.003] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0040.003] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png.badday" [0040.003] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.badday"), dwFlags=0x1) returned 1 [0040.003] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0040.004] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0040.004] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" [0040.004] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_to_back_files.html")) returned 0x20 [0040.004] GetProcessHeap () returned 0x560000 [0040.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.004] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 0 [0040.004] FindClose (in: hFindFile=0x579488 | out: hFindFile=0x579488) returned 1 [0040.004] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0040.004] GetProcessHeap () returned 0x560000 [0040.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x566e98 | out: hHeap=0x560000) returned 1 [0040.004] GetProcessHeap () returned 0x560000 [0040.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.004] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned 49 [0040.004] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*" [0040.004] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579748 [0040.004] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0040.004] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.004] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0040.004] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0040.005] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0040.005] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0040.005] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0040.005] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0040.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0040.005] GetProcessHeap () returned 0x560000 [0040.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x58a0e8 [0040.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="css", cchWideChar=-1, lpMultiByteStr=0x58a0e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 4 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0040.005] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0040.006] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0040.007] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0040.007] GetProcessHeap () returned 0x560000 [0040.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a168 [0040.007] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned 53 [0040.007] GetProcessHeap () returned 0x560000 [0040.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6c) returned 0x56f490 [0040.007] lstrcpyW (in: lpString1=0x56f490, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0040.007] GetProcessHeap () returned 0x560000 [0040.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.007] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0040.007] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0040.007] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0040.007] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0040.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0040.007] GetProcessHeap () returned 0x560000 [0040.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3) returned 0x58a158 [0040.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="js", cchWideChar=-1, lpMultiByteStr=0x58a158, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 3 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0040.007] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0040.008] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0040.008] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0040.008] GetProcessHeap () returned 0x560000 [0040.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0040.008] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned 52 [0040.008] GetProcessHeap () returned 0x560000 [0040.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6a) returned 0x572708 [0040.009] lstrcpyW (in: lpString1=0x572708, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0040.009] GetProcessHeap () returned 0x560000 [0040.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.009] FindNextFileW (in: hFindFile=0x579748, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0040.009] FindClose (in: hFindFile=0x579748 | out: hFindFile=0x579748) returned 1 [0040.009] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0040.009] GetProcessHeap () returned 0x560000 [0040.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.009] GetProcessHeap () returned 0x560000 [0040.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.009] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned 52 [0040.009] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*" [0040.009] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579608 [0040.011] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0040.011] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.011] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0040.011] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0040.011] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="base.js", cAlternateFileName="")) returned 1 [0040.011] lstrcmpiW (lpString1="base.js", lpString2=".") returned 1 [0040.011] lstrcmpiW (lpString1="base.js", lpString2="..") returned 1 [0040.011] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0040.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="base.js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.011] GetProcessHeap () returned 0x560000 [0040.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0a8 [0040.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="base.js", cchWideChar=-1, lpMultiByteStr=0x58a0a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.js", lpUsedDefaultChar=0x0) returned 8 [0040.011] lstrlenA (lpString="base.js") returned 7 [0040.011] lstrlenA (lpString=".badday") returned 7 [0040.012] lstrlenA (lpString=".badday") returned 7 [0040.012] lstrlenA (lpString="base.js") returned 7 [0040.012] lstrcmpiA (lpString1="base.js", lpString2=".badday") returned 1 [0040.012] lstrcmpiW (lpString1="base.js", lpString2="how_to_back_files.html") returned -1 [0040.012] lstrcmpiW (lpString1="base.js", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.012] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.012] lstrcmpiW (lpString1="base.js", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0040.012] GetProcessHeap () returned 0x560000 [0040.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0040.012] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.012] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1283526) returned 1 [0040.012] GetProcessHeap () returned 0x560000 [0040.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572708 [0040.012] GetProcessHeap () returned 0x560000 [0040.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.012] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned 59 [0040.012] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.012] GetProcessHeap () returned 0x560000 [0040.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.012] GetProcessHeap () returned 0x560000 [0040.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38a) returned 0x58a938 [0040.013] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.013] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x571ec8) returned 1 [0040.013] CryptGenRandom (in: hProv=0x571ec8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.013] CryptReleaseContext (hProv=0x571ec8, dwFlags=0x0) returned 1 [0040.013] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.013] GetProcessHeap () returned 0x560000 [0040.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.013] lstrlenA (lpString="010001") returned 6 [0040.013] GetProcessHeap () returned 0x560000 [0040.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0040.013] GetProcessHeap () returned 0x560000 [0040.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5727e8 [0040.013] GetProcessHeap () returned 0x560000 [0040.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584980 [0040.013] GetProcessHeap () returned 0x560000 [0040.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5727e8 | out: hHeap=0x560000) returned 1 [0040.013] GetProcessHeap () returned 0x560000 [0040.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584470 [0040.013] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5727e8 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a10 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5727e8 | out: hHeap=0x560000) returned 1 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a10 | out: hHeap=0x560000) returned 1 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e4a0 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584c50 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e4a0 | out: hHeap=0x560000) returned 1 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0040.014] GetProcessHeap () returned 0x560000 [0040.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c50 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.015] GetProcessHeap () returned 0x560000 [0040.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.016] GetProcessHeap () returned 0x560000 [0040.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.016] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.017] GetProcessHeap () returned 0x560000 [0040.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.017] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0040.018] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584470 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584980 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.019] GetProcessHeap () returned 0x560000 [0040.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.019] WriteFile (in: hFile=0x230, lpBuffer=0x58a938*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a938*, lpNumberOfBytesWritten=0x24ad864*=0x38a, lpOverlapped=0x0) returned 1 [0040.023] GetProcessHeap () returned 0x560000 [0040.023] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a938, Size=0x30) returned 0x58a938 [0040.023] GetProcessHeap () returned 0x560000 [0040.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.023] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.023] GetProcessHeap () returned 0x560000 [0040.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1395d0) returned 0x24ba020 [0040.042] ReadFile (in: hFile=0x230, lpBuffer=0x24ba020, nNumberOfBytesToRead=0x1395d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ba020*, lpNumberOfBytesRead=0x24ad7e8*=0x1395d0, lpOverlapped=0x0) returned 1 [0040.059] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.059] WriteFile (in: hFile=0x230, lpBuffer=0x24ba020*, nNumberOfBytesToWrite=0x1395d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24ba020*, lpNumberOfBytesWritten=0x24ad7e4*=0x1395d0, lpOverlapped=0x0) returned 1 [0040.126] GetProcessHeap () returned 0x560000 [0040.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24ba020 | out: hHeap=0x560000) returned 1 [0040.131] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.131] WriteFile (in: hFile=0x230, lpBuffer=0x58a938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a938*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.132] CloseHandle (hObject=0x230) returned 1 [0040.151] GetProcessHeap () returned 0x560000 [0040.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0040.151] GetProcessHeap () returned 0x560000 [0040.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.151] GetProcessHeap () returned 0x560000 [0040.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.151] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0040.151] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.badday" [0040.151] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.badday"), dwFlags=0x1) returned 1 [0040.152] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned 1 [0040.152] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="" [0040.152] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html" [0040.152] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\how_to_back_files.html")) returned 0xffffffff [0040.152] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0040.152] GetProcessHeap () returned 0x560000 [0040.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572708 [0040.152] GetProcessHeap () returned 0x560000 [0040.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.160] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.161] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.164] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.165] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.166] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.170] GetProcessHeap () returned 0x560000 [0040.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.170] GetProcessHeap () returned 0x560000 [0040.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.170] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0040.170] GetProcessHeap () returned 0x560000 [0040.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572708 [0040.170] GetProcessHeap () returned 0x560000 [0040.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.177] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.177] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.177] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.177] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.177] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.178] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.180] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.181] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.182] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.183] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.184] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.186] GetProcessHeap () returned 0x560000 [0040.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.186] GetProcessHeap () returned 0x560000 [0040.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.186] CloseHandle (hObject=0x230) returned 1 [0040.186] GetProcessHeap () returned 0x560000 [0040.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.186] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 1 [0040.186] lstrcmpiW (lpString1="ui.js", lpString2=".") returned 1 [0040.186] lstrcmpiW (lpString1="ui.js", lpString2="..") returned 1 [0040.186] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="ui.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0040.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui.js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0040.186] GetProcessHeap () returned 0x560000 [0040.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a098 [0040.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui.js", cchWideChar=-1, lpMultiByteStr=0x58a098, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui.js", lpUsedDefaultChar=0x0) returned 6 [0040.187] lstrlenA (lpString="ui.js") returned 5 [0040.187] lstrlenA (lpString=".badday") returned 7 [0040.187] lstrcmpiW (lpString1="ui.js", lpString2="how_to_back_files.html") returned 1 [0040.187] lstrcmpiW (lpString1="ui.js", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.187] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.187] lstrcmpiW (lpString1="ui.js", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0040.187] GetProcessHeap () returned 0x560000 [0040.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0040.187] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.187] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=3046842) returned 1 [0040.187] GetProcessHeap () returned 0x560000 [0040.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x572708 [0040.187] GetProcessHeap () returned 0x560000 [0040.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.187] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned 57 [0040.187] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.187] GetProcessHeap () returned 0x560000 [0040.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.187] GetProcessHeap () returned 0x560000 [0040.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58a970 [0040.187] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.187] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x571ec8) returned 1 [0040.188] CryptGenRandom (in: hProv=0x571ec8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.188] CryptReleaseContext (hProv=0x571ec8, dwFlags=0x0) returned 1 [0040.188] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.188] lstrlenA (lpString="010001") returned 6 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5727e8 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843e0 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5727e8 | out: hHeap=0x560000) returned 1 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586ec0 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0040.188] GetProcessHeap () returned 0x560000 [0040.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5727e8 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5727e8 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e248 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584c50 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e248 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c50 | out: hHeap=0x560000) returned 1 [0040.189] GetProcessHeap () returned 0x560000 [0040.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.190] GetProcessHeap () returned 0x560000 [0040.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.191] GetProcessHeap () returned 0x560000 [0040.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.191] GetProcessHeap () returned 0x560000 [0040.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.192] GetProcessHeap () returned 0x560000 [0040.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.243] GetProcessHeap () returned 0x560000 [0040.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.243] GetProcessHeap () returned 0x560000 [0040.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.243] GetProcessHeap () returned 0x560000 [0040.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.243] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.244] GetProcessHeap () returned 0x560000 [0040.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843e0 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.245] GetProcessHeap () returned 0x560000 [0040.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.245] WriteFile (in: hFile=0x230, lpBuffer=0x58a970*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a970*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0040.248] GetProcessHeap () returned 0x560000 [0040.248] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a970, Size=0x30) returned 0x58a970 [0040.249] GetProcessHeap () returned 0x560000 [0040.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.249] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.249] GetProcessHeap () returned 0x560000 [0040.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e7dba) returned 0x24b9020 [0040.293] ReadFile (in: hFile=0x230, lpBuffer=0x24b9020, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b9020*, lpNumberOfBytesRead=0x24ad7e8*=0x2e7dba, lpOverlapped=0x0) returned 1 [0040.350] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.350] WriteFile (in: hFile=0x230, lpBuffer=0x24b9020*, nNumberOfBytesToWrite=0x2e7dba, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b9020*, lpNumberOfBytesWritten=0x24ad7e4*=0x2e7dba, lpOverlapped=0x0) returned 1 [0040.572] GetProcessHeap () returned 0x560000 [0040.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b9020 | out: hHeap=0x560000) returned 1 [0040.584] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.584] WriteFile (in: hFile=0x230, lpBuffer=0x58a970*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a970*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.585] CloseHandle (hObject=0x230) returned 1 [0040.655] GetProcessHeap () returned 0x560000 [0040.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0040.655] GetProcessHeap () returned 0x560000 [0040.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.655] GetProcessHeap () returned 0x560000 [0040.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.655] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0040.655] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.badday" [0040.655] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.badday"), dwFlags=0x1) returned 1 [0040.656] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned 1 [0040.656] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="" [0040.656] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html" [0040.656] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\how_to_back_files.html")) returned 0x20 [0040.656] GetProcessHeap () returned 0x560000 [0040.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.656] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 0 [0040.656] FindClose (in: hFindFile=0x579608 | out: hFindFile=0x579608) returned 1 [0040.656] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0040.656] GetProcessHeap () returned 0x560000 [0040.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.656] GetProcessHeap () returned 0x560000 [0040.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0040.656] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned 53 [0040.657] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*" [0040.657] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579808 [0040.657] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0040.657] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.657] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0040.657] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0040.657] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0040.657] lstrcmpiW (lpString1="oobe-desktop.css", lpString2=".") returned 1 [0040.657] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="..") returned 1 [0040.657] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0040.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe-desktop.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0040.657] GetProcessHeap () returned 0x560000 [0040.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576a98 [0040.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe-desktop.css", cchWideChar=-1, lpMultiByteStr=0x576a98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe-desktop.css", lpUsedDefaultChar=0x0) returned 17 [0040.657] lstrlenA (lpString="oobe-desktop.css") returned 16 [0040.657] lstrlenA (lpString=".badday") returned 7 [0040.657] lstrlenA (lpString=".badday") returned 7 [0040.657] lstrlenA (lpString="oobe-desktop.css") returned 16 [0040.657] lstrcmpiA (lpString1="top.css", lpString2=".badday") returned 1 [0040.657] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="how_to_back_files.html") returned 1 [0040.657] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.657] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.657] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0040.657] GetProcessHeap () returned 0x560000 [0040.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0040.657] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.658] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=40953) returned 1 [0040.658] GetProcessHeap () returned 0x560000 [0040.658] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.658] GetProcessHeap () returned 0x560000 [0040.658] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.658] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned 69 [0040.658] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.658] GetProcessHeap () returned 0x560000 [0040.658] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.658] GetProcessHeap () returned 0x560000 [0040.658] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x387) returned 0x58a9a8 [0040.658] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.658] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0040.659] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.659] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0040.659] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.659] lstrlenA (lpString="010001") returned 6 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5842c0 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584470 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.659] GetProcessHeap () returned 0x560000 [0040.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0040.659] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584350 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584350 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e230 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d70 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e230 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d70 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.660] GetProcessHeap () returned 0x560000 [0040.660] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.661] GetProcessHeap () returned 0x560000 [0040.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.662] GetProcessHeap () returned 0x560000 [0040.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.662] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.663] GetProcessHeap () returned 0x560000 [0040.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.663] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.664] GetProcessHeap () returned 0x560000 [0040.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584470 | out: hHeap=0x560000) returned 1 [0040.665] GetProcessHeap () returned 0x560000 [0040.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0040.665] GetProcessHeap () returned 0x560000 [0040.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0040.665] GetProcessHeap () returned 0x560000 [0040.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0040.665] GetProcessHeap () returned 0x560000 [0040.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.665] GetProcessHeap () returned 0x560000 [0040.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.665] WriteFile (in: hFile=0x230, lpBuffer=0x58a9a8*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a9a8*, lpNumberOfBytesWritten=0x24ad864*=0x387, lpOverlapped=0x0) returned 1 [0040.668] GetProcessHeap () returned 0x560000 [0040.668] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a9a8, Size=0x30) returned 0x58a9a8 [0040.668] GetProcessHeap () returned 0x560000 [0040.668] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.669] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.669] GetProcessHeap () returned 0x560000 [0040.669] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa000) returned 0x59eb30 [0040.669] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0xa000, lpOverlapped=0x0) returned 1 [0040.671] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.671] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0xa000, lpOverlapped=0x0) returned 1 [0040.672] GetProcessHeap () returned 0x560000 [0040.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0040.673] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.673] WriteFile (in: hFile=0x230, lpBuffer=0x58a9a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a9a8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.674] CloseHandle (hObject=0x230) returned 1 [0040.676] GetProcessHeap () returned 0x560000 [0040.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0040.676] GetProcessHeap () returned 0x560000 [0040.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.676] GetProcessHeap () returned 0x560000 [0040.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.676] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0040.676] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.badday" [0040.676] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.badday"), dwFlags=0x1) returned 1 [0040.676] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned 1 [0040.676] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="" [0040.676] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html" [0040.676] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\how_to_back_files.html")) returned 0xffffffff [0040.676] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0040.677] GetProcessHeap () returned 0x560000 [0040.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.677] GetProcessHeap () returned 0x560000 [0040.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.694] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.696] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.696] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.696] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.696] GetProcessHeap () returned 0x560000 [0040.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.696] GetProcessHeap () returned 0x560000 [0040.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.696] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0040.696] GetProcessHeap () returned 0x560000 [0040.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.696] GetProcessHeap () returned 0x560000 [0040.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.702] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.702] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.712] GetProcessHeap () returned 0x560000 [0040.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.712] GetProcessHeap () returned 0x560000 [0040.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.712] CloseHandle (hObject=0x230) returned 1 [0040.712] GetProcessHeap () returned 0x560000 [0040.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a98 | out: hHeap=0x560000) returned 1 [0040.712] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0040.712] lstrcmpiW (lpString1="ui-dark.css", lpString2=".") returned 1 [0040.712] lstrcmpiW (lpString1="ui-dark.css", lpString2="..") returned 1 [0040.712] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0040.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui-dark.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.712] GetProcessHeap () returned 0x560000 [0040.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0040.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui-dark.css", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui-dark.css", lpUsedDefaultChar=0x0) returned 12 [0040.712] lstrlenA (lpString="ui-dark.css") returned 11 [0040.712] lstrlenA (lpString=".badday") returned 7 [0040.712] lstrlenA (lpString=".badday") returned 7 [0040.712] lstrlenA (lpString="ui-dark.css") returned 11 [0040.712] lstrcmpiA (lpString1="ark.css", lpString2=".badday") returned 1 [0040.712] lstrcmpiW (lpString1="ui-dark.css", lpString2="how_to_back_files.html") returned 1 [0040.712] lstrcmpiW (lpString1="ui-dark.css", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.712] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.712] lstrcmpiW (lpString1="ui-dark.css", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0040.712] GetProcessHeap () returned 0x560000 [0040.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0040.712] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.713] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=269159) returned 1 [0040.713] GetProcessHeap () returned 0x560000 [0040.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.713] GetProcessHeap () returned 0x560000 [0040.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.713] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned 64 [0040.713] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.713] GetProcessHeap () returned 0x560000 [0040.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.713] GetProcessHeap () returned 0x560000 [0040.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58a9e0 [0040.713] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.713] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0040.714] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.714] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0040.714] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.714] lstrlenA (lpString="010001") returned 6 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846b0 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584740 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.714] GetProcessHeap () returned 0x560000 [0040.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e218 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585040 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x56e368 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x585160 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e368 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585160 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.715] GetProcessHeap () returned 0x560000 [0040.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.716] GetProcessHeap () returned 0x560000 [0040.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.717] GetProcessHeap () returned 0x560000 [0040.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.718] GetProcessHeap () returned 0x560000 [0040.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e218 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.719] GetProcessHeap () returned 0x560000 [0040.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.719] WriteFile (in: hFile=0x230, lpBuffer=0x58a9e0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a9e0*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0040.745] GetProcessHeap () returned 0x560000 [0040.745] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58a9e0, Size=0x30) returned 0x58a9e0 [0040.745] GetProcessHeap () returned 0x560000 [0040.745] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.745] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.745] GetProcessHeap () returned 0x560000 [0040.745] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x41b70) returned 0x59eb30 [0040.749] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x41b70, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x41b70, lpOverlapped=0x0) returned 1 [0040.789] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.789] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x41b70, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x41b70, lpOverlapped=0x0) returned 1 [0040.801] GetProcessHeap () returned 0x560000 [0040.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0040.801] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.801] WriteFile (in: hFile=0x230, lpBuffer=0x58a9e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58a9e0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.803] CloseHandle (hObject=0x230) returned 1 [0040.808] GetProcessHeap () returned 0x560000 [0040.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0040.808] GetProcessHeap () returned 0x560000 [0040.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.808] GetProcessHeap () returned 0x560000 [0040.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.808] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0040.808] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.badday" [0040.808] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.badday"), dwFlags=0x1) returned 1 [0040.814] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned 1 [0040.814] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="" [0040.814] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html" [0040.814] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\how_to_back_files.html")) returned 0x20 [0040.814] GetProcessHeap () returned 0x560000 [0040.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.815] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0040.815] FindClose (in: hFindFile=0x579808 | out: hFindFile=0x579808) returned 1 [0040.815] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0040.815] GetProcessHeap () returned 0x560000 [0040.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b858 | out: hHeap=0x560000) returned 1 [0040.815] GetProcessHeap () returned 0x560000 [0040.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.815] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned 38 [0040.815] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*" [0040.815] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579488 [0040.825] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0040.825] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.835] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0040.835] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0040.835] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0040.835] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2=".") returned 1 [0040.835] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="..") returned 1 [0040.835] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0040.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ar-sa.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0040.835] GetProcessHeap () returned 0x560000 [0040.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0040.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ar-sa.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ar-sa.htm", lpUsedDefaultChar=0x0) returned 15 [0040.835] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0040.835] lstrlenA (lpString=".badday") returned 7 [0040.835] lstrlenA (lpString=".badday") returned 7 [0040.835] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0040.835] lstrcmpiA (lpString1="-sa.htm", lpString2=".badday") returned 1 [0040.835] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="how_to_back_files.html") returned -1 [0040.835] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.835] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.835] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0040.835] GetProcessHeap () returned 0x560000 [0040.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0040.835] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.836] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=110445) returned 1 [0040.836] GetProcessHeap () returned 0x560000 [0040.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.836] GetProcessHeap () returned 0x560000 [0040.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.836] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned 52 [0040.836] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.836] GetProcessHeap () returned 0x560000 [0040.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.836] GetProcessHeap () returned 0x560000 [0040.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58aa18 [0040.836] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.836] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0040.837] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.837] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0040.837] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.837] lstrlenA (lpString="010001") returned 6 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584860 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584e00 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.837] GetProcessHeap () returned 0x560000 [0040.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589108 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584620 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584620 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891c8 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584980 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891c8 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584980 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.838] GetProcessHeap () returned 0x560000 [0040.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.838] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.839] GetProcessHeap () returned 0x560000 [0040.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.840] GetProcessHeap () returned 0x560000 [0040.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.841] GetProcessHeap () returned 0x560000 [0040.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.841] GetProcessHeap () returned 0x560000 [0040.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589108 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e00 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584860 | out: hHeap=0x560000) returned 1 [0040.842] GetProcessHeap () returned 0x560000 [0040.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0040.843] GetProcessHeap () returned 0x560000 [0040.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.843] GetProcessHeap () returned 0x560000 [0040.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.843] WriteFile (in: hFile=0x230, lpBuffer=0x58aa18*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aa18*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0040.849] GetProcessHeap () returned 0x560000 [0040.849] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58aa18, Size=0x30) returned 0x58aa18 [0040.849] GetProcessHeap () returned 0x560000 [0040.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.849] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.849] GetProcessHeap () returned 0x560000 [0040.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1af6d) returned 0x59eb30 [0040.849] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x1af6d, lpOverlapped=0x0) returned 1 [0040.852] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.852] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x1af6d, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x1af6d, lpOverlapped=0x0) returned 1 [0040.856] GetProcessHeap () returned 0x560000 [0040.856] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0040.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.856] WriteFile (in: hFile=0x230, lpBuffer=0x58aa18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aa18*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.857] CloseHandle (hObject=0x230) returned 1 [0040.859] GetProcessHeap () returned 0x560000 [0040.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0040.860] GetProcessHeap () returned 0x560000 [0040.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.860] GetProcessHeap () returned 0x560000 [0040.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.860] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0040.860] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.badday" [0040.860] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.badday"), dwFlags=0x1) returned 1 [0040.860] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0040.860] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0040.860] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0040.860] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0xffffffff [0040.860] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0040.861] GetProcessHeap () returned 0x560000 [0040.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.861] GetProcessHeap () returned 0x560000 [0040.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.867] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.868] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.871] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.879] GetProcessHeap () returned 0x560000 [0040.879] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.879] GetProcessHeap () returned 0x560000 [0040.879] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.879] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0040.879] GetProcessHeap () returned 0x560000 [0040.879] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.879] GetProcessHeap () returned 0x560000 [0040.879] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.885] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.885] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.887] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.891] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.892] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.894] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0040.894] GetProcessHeap () returned 0x560000 [0040.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.894] GetProcessHeap () returned 0x560000 [0040.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.894] CloseHandle (hObject=0x230) returned 1 [0040.894] GetProcessHeap () returned 0x560000 [0040.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.894] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0040.894] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2=".") returned 1 [0040.894] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="..") returned 1 [0040.894] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0040.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_bg-bg.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0040.894] GetProcessHeap () returned 0x560000 [0040.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0040.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_bg-bg.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_bg-bg.htm", lpUsedDefaultChar=0x0) returned 15 [0040.895] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0040.895] lstrlenA (lpString=".badday") returned 7 [0040.895] lstrlenA (lpString=".badday") returned 7 [0040.895] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0040.895] lstrcmpiA (lpString1="-bg.htm", lpString2=".badday") returned 1 [0040.895] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="how_to_back_files.html") returned -1 [0040.895] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.895] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.895] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0040.895] GetProcessHeap () returned 0x560000 [0040.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0040.895] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.895] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=253453) returned 1 [0040.895] GetProcessHeap () returned 0x560000 [0040.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.895] GetProcessHeap () returned 0x560000 [0040.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.935] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned 52 [0040.935] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.935] GetProcessHeap () returned 0x560000 [0040.935] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.935] GetProcessHeap () returned 0x560000 [0040.935] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x58aa50 [0040.935] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.935] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58ade0) returned 1 [0040.935] CryptGenRandom (in: hProv=0x58ade0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.936] CryptReleaseContext (hProv=0x58ade0, dwFlags=0x0) returned 1 [0040.936] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58ade0 [0040.936] lstrlenA (lpString="010001") returned 6 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584fe0 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584608 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891f8 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0040.936] GetProcessHeap () returned 0x560000 [0040.936] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589168 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587380 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589168 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.937] GetProcessHeap () returned 0x560000 [0040.937] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.938] GetProcessHeap () returned 0x560000 [0040.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.938] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.939] GetProcessHeap () returned 0x560000 [0040.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.940] GetProcessHeap () returned 0x560000 [0040.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891f8 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.941] GetProcessHeap () returned 0x560000 [0040.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ade0 | out: hHeap=0x560000) returned 1 [0040.941] WriteFile (in: hFile=0x230, lpBuffer=0x58aa50*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aa50*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0040.957] GetProcessHeap () returned 0x560000 [0040.957] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58aa50, Size=0x30) returned 0x58aa50 [0040.957] GetProcessHeap () returned 0x560000 [0040.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0040.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.957] GetProcessHeap () returned 0x560000 [0040.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3de10) returned 0x59eb30 [0040.957] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x3de10, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x3de10, lpOverlapped=0x0) returned 1 [0040.961] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0040.961] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x3de10, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x3de10, lpOverlapped=0x0) returned 1 [0040.964] GetProcessHeap () returned 0x560000 [0040.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0040.965] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.965] WriteFile (in: hFile=0x230, lpBuffer=0x58aa50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aa50*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0040.969] CloseHandle (hObject=0x230) returned 1 [0040.974] GetProcessHeap () returned 0x560000 [0040.974] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0040.974] GetProcessHeap () returned 0x560000 [0040.974] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0040.974] GetProcessHeap () returned 0x560000 [0040.974] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0040.974] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0040.974] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.badday" [0040.974] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.badday"), dwFlags=0x1) returned 1 [0040.974] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0040.974] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0040.974] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0040.975] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0040.975] GetProcessHeap () returned 0x560000 [0040.975] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0040.975] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0040.975] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2=".") returned 1 [0040.975] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="..") returned 1 [0040.975] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0040.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_cs-cz.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0040.975] GetProcessHeap () returned 0x560000 [0040.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0040.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_cs-cz.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_cs-cz.htm", lpUsedDefaultChar=0x0) returned 15 [0040.975] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0040.975] lstrlenA (lpString=".badday") returned 7 [0040.975] lstrlenA (lpString=".badday") returned 7 [0040.975] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0040.975] lstrcmpiA (lpString1="-cz.htm", lpString2=".badday") returned 1 [0040.975] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="how_to_back_files.html") returned -1 [0040.975] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0040.975] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0040.975] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0040.975] GetProcessHeap () returned 0x560000 [0040.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0040.975] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0040.975] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=83315) returned 1 [0040.976] GetProcessHeap () returned 0x560000 [0040.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0040.976] GetProcessHeap () returned 0x560000 [0040.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0040.976] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned 52 [0040.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0040.976] GetProcessHeap () returned 0x560000 [0040.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0040.976] GetProcessHeap () returned 0x560000 [0040.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58aa88 [0040.976] lstrlenA (lpString="rsa_encrypt") returned 11 [0040.976] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0040.976] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0040.976] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0040.976] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0040.976] GetProcessHeap () returned 0x560000 [0040.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0040.977] lstrlenA (lpString="010001") returned 6 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5844f0 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584838 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589078 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0040.977] GetProcessHeap () returned 0x560000 [0040.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x588fe8 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586d50 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x588fe8 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.978] GetProcessHeap () returned 0x560000 [0040.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.979] GetProcessHeap () returned 0x560000 [0040.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0040.980] GetProcessHeap () returned 0x560000 [0040.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0040.981] GetProcessHeap () returned 0x560000 [0040.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0040.981] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589078 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0040.982] GetProcessHeap () returned 0x560000 [0040.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0040.982] WriteFile (in: hFile=0x230, lpBuffer=0x58aa88*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aa88*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0041.253] GetProcessHeap () returned 0x560000 [0041.253] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58aa88, Size=0x30) returned 0x58aa88 [0041.253] GetProcessHeap () returned 0x560000 [0041.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.253] GetProcessHeap () returned 0x560000 [0041.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14580) returned 0x59eb30 [0041.263] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x14580, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x14580, lpOverlapped=0x0) returned 1 [0041.266] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.266] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x14580, lpOverlapped=0x0) returned 1 [0041.278] GetProcessHeap () returned 0x560000 [0041.278] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.278] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.278] WriteFile (in: hFile=0x230, lpBuffer=0x58aa88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aa88*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.281] CloseHandle (hObject=0x230) returned 1 [0041.283] GetProcessHeap () returned 0x560000 [0041.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0041.283] GetProcessHeap () returned 0x560000 [0041.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.283] GetProcessHeap () returned 0x560000 [0041.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.283] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0041.284] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.badday" [0041.284] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.badday"), dwFlags=0x1) returned 1 [0041.284] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.284] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.284] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.284] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.284] GetProcessHeap () returned 0x560000 [0041.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.284] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0041.284] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2=".") returned 1 [0041.284] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="..") returned 1 [0041.285] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0041.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_da-dk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.285] GetProcessHeap () returned 0x560000 [0041.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_da-dk.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_da-dk.htm", lpUsedDefaultChar=0x0) returned 15 [0041.285] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0041.285] lstrlenA (lpString=".badday") returned 7 [0041.285] lstrlenA (lpString=".badday") returned 7 [0041.285] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0041.285] lstrcmpiA (lpString1="-dk.htm", lpString2=".badday") returned 1 [0041.285] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="how_to_back_files.html") returned -1 [0041.285] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.285] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.285] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.285] GetProcessHeap () returned 0x560000 [0041.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0041.285] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.286] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=65173) returned 1 [0041.286] GetProcessHeap () returned 0x560000 [0041.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.286] GetProcessHeap () returned 0x560000 [0041.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.286] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned 52 [0041.286] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.286] GetProcessHeap () returned 0x560000 [0041.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.286] GetProcessHeap () returned 0x560000 [0041.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58aac0 [0041.286] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.286] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.287] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.287] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.287] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.287] lstrlenA (lpString="010001") returned 6 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5850f8 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584950 [0041.287] GetProcessHeap () returned 0x560000 [0041.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589378 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589390 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f00 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589390 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.288] GetProcessHeap () returned 0x560000 [0041.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.288] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.289] GetProcessHeap () returned 0x560000 [0041.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.289] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.290] GetProcessHeap () returned 0x560000 [0041.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.291] GetProcessHeap () returned 0x560000 [0041.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.292] GetProcessHeap () returned 0x560000 [0041.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589378 | out: hHeap=0x560000) returned 1 [0041.293] GetProcessHeap () returned 0x560000 [0041.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0041.293] GetProcessHeap () returned 0x560000 [0041.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.293] GetProcessHeap () returned 0x560000 [0041.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0041.293] GetProcessHeap () returned 0x560000 [0041.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0041.293] GetProcessHeap () returned 0x560000 [0041.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.293] GetProcessHeap () returned 0x560000 [0041.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.293] WriteFile (in: hFile=0x230, lpBuffer=0x58aac0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aac0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.301] GetProcessHeap () returned 0x560000 [0041.301] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58aac0, Size=0x30) returned 0x58aac0 [0041.301] GetProcessHeap () returned 0x560000 [0041.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.301] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.301] GetProcessHeap () returned 0x560000 [0041.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfe95) returned 0x59eb30 [0041.301] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0xfe95, lpOverlapped=0x0) returned 1 [0041.303] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.303] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0xfe95, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0xfe95, lpOverlapped=0x0) returned 1 [0041.304] GetProcessHeap () returned 0x560000 [0041.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.306] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.306] WriteFile (in: hFile=0x230, lpBuffer=0x58aac0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aac0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.307] CloseHandle (hObject=0x230) returned 1 [0041.309] GetProcessHeap () returned 0x560000 [0041.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0041.309] GetProcessHeap () returned 0x560000 [0041.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.309] GetProcessHeap () returned 0x560000 [0041.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.309] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0041.309] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.badday" [0041.309] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.badday"), dwFlags=0x1) returned 1 [0041.310] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.310] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.310] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.310] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.310] GetProcessHeap () returned 0x560000 [0041.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.310] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0041.310] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2=".") returned 1 [0041.310] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="..") returned 1 [0041.310] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0041.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_de-de.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.313] GetProcessHeap () returned 0x560000 [0041.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_de-de.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_de-de.htm", lpUsedDefaultChar=0x0) returned 15 [0041.313] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0041.313] lstrlenA (lpString=".badday") returned 7 [0041.313] lstrlenA (lpString=".badday") returned 7 [0041.313] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0041.313] lstrcmpiA (lpString1="-de.htm", lpString2=".badday") returned 1 [0041.313] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="how_to_back_files.html") returned -1 [0041.313] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.313] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.313] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.313] GetProcessHeap () returned 0x560000 [0041.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0041.313] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.313] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=70461) returned 1 [0041.313] GetProcessHeap () returned 0x560000 [0041.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.313] GetProcessHeap () returned 0x560000 [0041.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.313] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned 52 [0041.313] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.314] GetProcessHeap () returned 0x560000 [0041.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.314] GetProcessHeap () returned 0x560000 [0041.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x58aaf8 [0041.314] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.314] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.314] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.314] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.314] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.314] GetProcessHeap () returned 0x560000 [0041.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.314] lstrlenA (lpString="010001") returned 6 [0041.314] GetProcessHeap () returned 0x560000 [0041.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0041.314] GetProcessHeap () returned 0x560000 [0041.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584608 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584ec8 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589318 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892d0 [0041.315] GetProcessHeap () returned 0x560000 [0041.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.315] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5871d0 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892d0 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.316] GetProcessHeap () returned 0x560000 [0041.316] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.316] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.317] GetProcessHeap () returned 0x560000 [0041.317] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.317] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.318] GetProcessHeap () returned 0x560000 [0041.318] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.318] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.319] GetProcessHeap () returned 0x560000 [0041.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589318 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.320] GetProcessHeap () returned 0x560000 [0041.320] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.320] WriteFile (in: hFile=0x230, lpBuffer=0x58aaf8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aaf8*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0041.338] GetProcessHeap () returned 0x560000 [0041.338] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58aaf8, Size=0x30) returned 0x58aaf8 [0041.338] GetProcessHeap () returned 0x560000 [0041.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.338] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.338] GetProcessHeap () returned 0x560000 [0041.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11340) returned 0x59eb30 [0041.340] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x11340, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x11340, lpOverlapped=0x0) returned 1 [0041.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.342] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x11340, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x11340, lpOverlapped=0x0) returned 1 [0041.344] GetProcessHeap () returned 0x560000 [0041.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.345] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.345] WriteFile (in: hFile=0x230, lpBuffer=0x58aaf8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58aaf8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.346] CloseHandle (hObject=0x230) returned 1 [0041.348] GetProcessHeap () returned 0x560000 [0041.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0041.348] GetProcessHeap () returned 0x560000 [0041.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.348] GetProcessHeap () returned 0x560000 [0041.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.348] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0041.348] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.badday" [0041.348] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.badday"), dwFlags=0x1) returned 1 [0041.349] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.349] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.349] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.349] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.349] GetProcessHeap () returned 0x560000 [0041.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.349] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0041.349] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2=".") returned 1 [0041.349] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="..") returned 1 [0041.349] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0041.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_el-gr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.349] GetProcessHeap () returned 0x560000 [0041.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_el-gr.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_el-gr.htm", lpUsedDefaultChar=0x0) returned 15 [0041.349] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0041.349] lstrlenA (lpString=".badday") returned 7 [0041.349] lstrlenA (lpString=".badday") returned 7 [0041.349] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0041.349] lstrcmpiA (lpString1="-gr.htm", lpString2=".badday") returned 1 [0041.349] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="how_to_back_files.html") returned -1 [0041.349] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.349] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.349] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.349] GetProcessHeap () returned 0x560000 [0041.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0041.349] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.350] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=239446) returned 1 [0041.350] GetProcessHeap () returned 0x560000 [0041.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.350] GetProcessHeap () returned 0x560000 [0041.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.350] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned 52 [0041.350] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.350] GetProcessHeap () returned 0x560000 [0041.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.350] GetProcessHeap () returned 0x560000 [0041.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5893a8 [0041.350] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.350] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.351] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.351] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.351] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.351] lstrlenA (lpString="010001") returned 6 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5844f0 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584720 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589180 [0041.351] GetProcessHeap () returned 0x560000 [0041.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589138 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f00 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589138 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.352] GetProcessHeap () returned 0x560000 [0041.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.353] GetProcessHeap () returned 0x560000 [0041.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.353] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.354] GetProcessHeap () returned 0x560000 [0041.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.354] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.355] GetProcessHeap () returned 0x560000 [0041.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589180 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.356] GetProcessHeap () returned 0x560000 [0041.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.356] WriteFile (in: hFile=0x230, lpBuffer=0x5893a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5893a8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.363] GetProcessHeap () returned 0x560000 [0041.363] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5893a8, Size=0x30) returned 0x5893a8 [0041.363] GetProcessHeap () returned 0x560000 [0041.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.363] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.363] GetProcessHeap () returned 0x560000 [0041.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3a756) returned 0x59eb30 [0041.367] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x3a756, lpOverlapped=0x0) returned 1 [0041.371] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.371] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x3a756, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x3a756, lpOverlapped=0x0) returned 1 [0041.421] GetProcessHeap () returned 0x560000 [0041.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.421] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.421] WriteFile (in: hFile=0x230, lpBuffer=0x5893a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5893a8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.423] CloseHandle (hObject=0x230) returned 1 [0041.434] GetProcessHeap () returned 0x560000 [0041.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0041.434] GetProcessHeap () returned 0x560000 [0041.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.434] GetProcessHeap () returned 0x560000 [0041.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.434] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0041.434] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.badday" [0041.434] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.badday"), dwFlags=0x1) returned 1 [0041.435] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.435] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.435] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.435] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.435] GetProcessHeap () returned 0x560000 [0041.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.435] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0041.435] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2=".") returned 1 [0041.435] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="..") returned 1 [0041.435] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0041.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-gb.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.435] GetProcessHeap () returned 0x560000 [0041.435] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-gb.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_en-gb.htm", lpUsedDefaultChar=0x0) returned 15 [0041.435] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0041.435] lstrlenA (lpString=".badday") returned 7 [0041.435] lstrlenA (lpString=".badday") returned 7 [0041.435] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0041.435] lstrcmpiA (lpString1="-gb.htm", lpString2=".badday") returned 1 [0041.436] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="how_to_back_files.html") returned -1 [0041.436] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.436] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.436] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.436] GetProcessHeap () returned 0x560000 [0041.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0041.436] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.436] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=58549) returned 1 [0041.436] GetProcessHeap () returned 0x560000 [0041.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.436] GetProcessHeap () returned 0x560000 [0041.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.436] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned 52 [0041.436] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.436] GetProcessHeap () returned 0x560000 [0041.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.436] GetProcessHeap () returned 0x560000 [0041.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5893e0 [0041.436] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.437] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.437] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.437] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.437] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.437] GetProcessHeap () returned 0x560000 [0041.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.437] lstrlenA (lpString="010001") returned 6 [0041.437] GetProcessHeap () returned 0x560000 [0041.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0041.437] GetProcessHeap () returned 0x560000 [0041.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.437] GetProcessHeap () returned 0x560000 [0041.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0041.437] GetProcessHeap () returned 0x560000 [0041.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584838 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584a68 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589030 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589240 [0041.438] GetProcessHeap () returned 0x560000 [0041.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.438] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587530 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589240 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.439] GetProcessHeap () returned 0x560000 [0041.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.440] GetProcessHeap () returned 0x560000 [0041.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.441] GetProcessHeap () returned 0x560000 [0041.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.442] GetProcessHeap () returned 0x560000 [0041.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589030 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.443] GetProcessHeap () returned 0x560000 [0041.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.444] WriteFile (in: hFile=0x230, lpBuffer=0x5893e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5893e0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.447] GetProcessHeap () returned 0x560000 [0041.447] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5893e0, Size=0x30) returned 0x5893e0 [0041.447] GetProcessHeap () returned 0x560000 [0041.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.447] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.447] GetProcessHeap () returned 0x560000 [0041.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe4b5) returned 0x59eb30 [0041.447] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0xe4b5, lpOverlapped=0x0) returned 1 [0041.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.448] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0xe4b5, lpOverlapped=0x0) returned 1 [0041.457] GetProcessHeap () returned 0x560000 [0041.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.459] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.459] WriteFile (in: hFile=0x230, lpBuffer=0x5893e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5893e0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.461] CloseHandle (hObject=0x230) returned 1 [0041.463] GetProcessHeap () returned 0x560000 [0041.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0041.463] GetProcessHeap () returned 0x560000 [0041.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.463] GetProcessHeap () returned 0x560000 [0041.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.463] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0041.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.badday" [0041.463] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.badday"), dwFlags=0x1) returned 1 [0041.464] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.464] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.464] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.464] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.464] GetProcessHeap () returned 0x560000 [0041.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.464] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0041.464] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2=".") returned 1 [0041.464] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="..") returned 1 [0041.464] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0041.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-us.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.464] GetProcessHeap () returned 0x560000 [0041.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-us.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_en-us.htm", lpUsedDefaultChar=0x0) returned 15 [0041.464] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0041.464] lstrlenA (lpString=".badday") returned 7 [0041.464] lstrlenA (lpString=".badday") returned 7 [0041.464] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0041.464] lstrcmpiA (lpString1="-us.htm", lpString2=".badday") returned 1 [0041.464] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="how_to_back_files.html") returned -1 [0041.464] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.464] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.464] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.464] GetProcessHeap () returned 0x560000 [0041.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0041.464] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.465] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=58549) returned 1 [0041.465] GetProcessHeap () returned 0x560000 [0041.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.465] GetProcessHeap () returned 0x560000 [0041.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.465] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned 52 [0041.465] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.465] GetProcessHeap () returned 0x560000 [0041.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.466] GetProcessHeap () returned 0x560000 [0041.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589418 [0041.466] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.466] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.466] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.466] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.466] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.466] GetProcessHeap () returned 0x560000 [0041.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.466] lstrlenA (lpString="010001") returned 6 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.467] GetProcessHeap () returned 0x560000 [0041.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5850f8 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891c8 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589030 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589030 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.468] GetProcessHeap () returned 0x560000 [0041.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.469] GetProcessHeap () returned 0x560000 [0041.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.470] GetProcessHeap () returned 0x560000 [0041.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.471] GetProcessHeap () returned 0x560000 [0041.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.472] GetProcessHeap () returned 0x560000 [0041.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891c8 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.473] GetProcessHeap () returned 0x560000 [0041.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.473] WriteFile (in: hFile=0x230, lpBuffer=0x589418*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589418*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.476] GetProcessHeap () returned 0x560000 [0041.476] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589418, Size=0x30) returned 0x589418 [0041.476] GetProcessHeap () returned 0x560000 [0041.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.477] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.477] GetProcessHeap () returned 0x560000 [0041.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe4b5) returned 0x59eb30 [0041.478] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0xe4b5, lpOverlapped=0x0) returned 1 [0041.480] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.481] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0xe4b5, lpOverlapped=0x0) returned 1 [0041.482] GetProcessHeap () returned 0x560000 [0041.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.482] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.482] WriteFile (in: hFile=0x230, lpBuffer=0x589418*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589418*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.483] CloseHandle (hObject=0x230) returned 1 [0041.485] GetProcessHeap () returned 0x560000 [0041.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0041.485] GetProcessHeap () returned 0x560000 [0041.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.485] GetProcessHeap () returned 0x560000 [0041.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.485] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0041.485] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.badday" [0041.485] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.badday"), dwFlags=0x1) returned 1 [0041.485] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.485] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.485] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.486] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.486] GetProcessHeap () returned 0x560000 [0041.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.486] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0041.486] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2=".") returned 1 [0041.486] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="..") returned 1 [0041.486] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0041.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-es.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.486] GetProcessHeap () returned 0x560000 [0041.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-es.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_es-es.htm", lpUsedDefaultChar=0x0) returned 15 [0041.486] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0041.486] lstrlenA (lpString=".badday") returned 7 [0041.486] lstrlenA (lpString=".badday") returned 7 [0041.486] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0041.486] lstrcmpiA (lpString1="-es.htm", lpString2=".badday") returned 1 [0041.486] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="how_to_back_files.html") returned -1 [0041.486] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.486] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.486] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.486] GetProcessHeap () returned 0x560000 [0041.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0041.486] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.487] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=69816) returned 1 [0041.487] GetProcessHeap () returned 0x560000 [0041.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.487] GetProcessHeap () returned 0x560000 [0041.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.487] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned 52 [0041.487] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.487] GetProcessHeap () returned 0x560000 [0041.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.487] GetProcessHeap () returned 0x560000 [0041.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x589450 [0041.487] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.487] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.488] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.488] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.488] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.488] lstrlenA (lpString="010001") returned 6 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584b80 [0041.488] GetProcessHeap () returned 0x560000 [0041.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5890f0 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x588fd0 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586cc0 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x588fd0 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.489] GetProcessHeap () returned 0x560000 [0041.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.490] GetProcessHeap () returned 0x560000 [0041.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.490] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.491] GetProcessHeap () returned 0x560000 [0041.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.492] GetProcessHeap () returned 0x560000 [0041.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.493] GetProcessHeap () returned 0x560000 [0041.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.493] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5890f0 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.494] GetProcessHeap () returned 0x560000 [0041.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.494] WriteFile (in: hFile=0x230, lpBuffer=0x589450*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589450*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0041.502] GetProcessHeap () returned 0x560000 [0041.502] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589450, Size=0x30) returned 0x589450 [0041.502] GetProcessHeap () returned 0x560000 [0041.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.502] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.502] GetProcessHeap () returned 0x560000 [0041.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x110c0) returned 0x59eb30 [0041.502] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x110c0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x110c0, lpOverlapped=0x0) returned 1 [0041.509] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.509] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x110c0, lpOverlapped=0x0) returned 1 [0041.511] GetProcessHeap () returned 0x560000 [0041.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.512] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.512] WriteFile (in: hFile=0x230, lpBuffer=0x589450*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589450*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.513] CloseHandle (hObject=0x230) returned 1 [0041.536] GetProcessHeap () returned 0x560000 [0041.536] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0041.536] GetProcessHeap () returned 0x560000 [0041.536] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.536] GetProcessHeap () returned 0x560000 [0041.536] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.536] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0041.536] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.badday" [0041.536] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.badday"), dwFlags=0x1) returned 1 [0041.537] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.537] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.537] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.537] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.537] GetProcessHeap () returned 0x560000 [0041.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.537] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0041.537] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2=".") returned 1 [0041.537] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="..") returned 1 [0041.537] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0041.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-mx.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.537] GetProcessHeap () returned 0x560000 [0041.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-mx.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_es-mx.htm", lpUsedDefaultChar=0x0) returned 15 [0041.537] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0041.537] lstrlenA (lpString=".badday") returned 7 [0041.537] lstrlenA (lpString=".badday") returned 7 [0041.537] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0041.537] lstrcmpiA (lpString1="-mx.htm", lpString2=".badday") returned 1 [0041.537] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="how_to_back_files.html") returned -1 [0041.538] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.538] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.538] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.538] GetProcessHeap () returned 0x560000 [0041.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0041.538] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.538] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=69816) returned 1 [0041.538] GetProcessHeap () returned 0x560000 [0041.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.538] GetProcessHeap () returned 0x560000 [0041.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.538] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned 52 [0041.538] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.538] GetProcessHeap () returned 0x560000 [0041.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.538] GetProcessHeap () returned 0x560000 [0041.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x589488 [0041.538] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.538] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.539] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.539] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.539] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.539] GetProcessHeap () returned 0x560000 [0041.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.539] lstrlenA (lpString="010001") returned 6 [0041.539] GetProcessHeap () returned 0x560000 [0041.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0041.539] GetProcessHeap () returned 0x560000 [0041.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.539] GetProcessHeap () returned 0x560000 [0041.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0041.539] GetProcessHeap () returned 0x560000 [0041.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.539] GetProcessHeap () returned 0x560000 [0041.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584838 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584c98 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892b8 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589048 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.540] GetProcessHeap () returned 0x560000 [0041.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589048 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.541] GetProcessHeap () returned 0x560000 [0041.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.542] GetProcessHeap () returned 0x560000 [0041.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.543] GetProcessHeap () returned 0x560000 [0041.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.543] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.544] GetProcessHeap () returned 0x560000 [0041.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.544] GetProcessHeap () returned 0x560000 [0041.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.545] GetProcessHeap () returned 0x560000 [0041.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.545] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892b8 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.546] GetProcessHeap () returned 0x560000 [0041.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.546] WriteFile (in: hFile=0x230, lpBuffer=0x589488*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589488*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0041.549] GetProcessHeap () returned 0x560000 [0041.549] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589488, Size=0x30) returned 0x589488 [0041.549] GetProcessHeap () returned 0x560000 [0041.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.549] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.549] GetProcessHeap () returned 0x560000 [0041.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x110c0) returned 0x59eb30 [0041.551] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x110c0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x110c0, lpOverlapped=0x0) returned 1 [0041.553] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.553] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x110c0, lpOverlapped=0x0) returned 1 [0041.579] GetProcessHeap () returned 0x560000 [0041.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.579] WriteFile (in: hFile=0x230, lpBuffer=0x589488*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589488*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.580] CloseHandle (hObject=0x230) returned 1 [0041.582] GetProcessHeap () returned 0x560000 [0041.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0041.582] GetProcessHeap () returned 0x560000 [0041.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.582] GetProcessHeap () returned 0x560000 [0041.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.583] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0041.583] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.badday" [0041.583] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.badday"), dwFlags=0x1) returned 1 [0041.583] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.583] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.583] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.583] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.583] GetProcessHeap () returned 0x560000 [0041.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.583] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0041.583] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2=".") returned 1 [0041.584] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="..") returned 1 [0041.584] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0041.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_et-ee.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.584] GetProcessHeap () returned 0x560000 [0041.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_et-ee.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_et-ee.htm", lpUsedDefaultChar=0x0) returned 15 [0041.584] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0041.584] lstrlenA (lpString=".badday") returned 7 [0041.584] lstrlenA (lpString=".badday") returned 7 [0041.584] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0041.584] lstrcmpiA (lpString1="-ee.htm", lpString2=".badday") returned 1 [0041.584] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="how_to_back_files.html") returned -1 [0041.584] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.584] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.584] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.584] GetProcessHeap () returned 0x560000 [0041.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0041.584] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.584] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=63101) returned 1 [0041.584] GetProcessHeap () returned 0x560000 [0041.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.584] GetProcessHeap () returned 0x560000 [0041.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.585] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned 52 [0041.585] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.585] GetProcessHeap () returned 0x560000 [0041.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.585] GetProcessHeap () returned 0x560000 [0041.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5894c0 [0041.585] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.585] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.585] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.585] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.585] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.585] GetProcessHeap () returned 0x560000 [0041.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.586] lstrlenA (lpString="010001") returned 6 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584db0 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584ec8 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5890c0 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0041.586] GetProcessHeap () returned 0x560000 [0041.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.586] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589150 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587260 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589150 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.587] GetProcessHeap () returned 0x560000 [0041.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.587] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.588] GetProcessHeap () returned 0x560000 [0041.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.589] GetProcessHeap () returned 0x560000 [0041.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.590] GetProcessHeap () returned 0x560000 [0041.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.590] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.591] GetProcessHeap () returned 0x560000 [0041.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.591] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5890c0 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0041.592] GetProcessHeap () returned 0x560000 [0041.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.593] GetProcessHeap () returned 0x560000 [0041.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.593] WriteFile (in: hFile=0x230, lpBuffer=0x5894c0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5894c0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.598] GetProcessHeap () returned 0x560000 [0041.598] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5894c0, Size=0x30) returned 0x5894c0 [0041.598] GetProcessHeap () returned 0x560000 [0041.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.598] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.598] GetProcessHeap () returned 0x560000 [0041.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf67d) returned 0x59eb30 [0041.598] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0xf67d, lpOverlapped=0x0) returned 1 [0041.600] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.600] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0xf67d, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0xf67d, lpOverlapped=0x0) returned 1 [0041.601] GetProcessHeap () returned 0x560000 [0041.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.602] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.602] WriteFile (in: hFile=0x230, lpBuffer=0x5894c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5894c0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.603] CloseHandle (hObject=0x230) returned 1 [0041.605] GetProcessHeap () returned 0x560000 [0041.605] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0041.605] GetProcessHeap () returned 0x560000 [0041.606] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.606] GetProcessHeap () returned 0x560000 [0041.606] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.606] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0041.606] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.badday" [0041.606] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.badday"), dwFlags=0x1) returned 1 [0041.606] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.606] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.606] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.606] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.606] GetProcessHeap () returned 0x560000 [0041.606] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.606] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0041.606] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2=".") returned 1 [0041.607] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="..") returned 1 [0041.607] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0041.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fi-fi.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.607] GetProcessHeap () returned 0x560000 [0041.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fi-fi.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fi-fi.htm", lpUsedDefaultChar=0x0) returned 15 [0041.607] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0041.607] lstrlenA (lpString=".badday") returned 7 [0041.607] lstrlenA (lpString=".badday") returned 7 [0041.607] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0041.607] lstrcmpiA (lpString1="-fi.htm", lpString2=".badday") returned 1 [0041.607] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="how_to_back_files.html") returned -1 [0041.607] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.607] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.607] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.607] GetProcessHeap () returned 0x560000 [0041.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0041.607] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.608] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=70746) returned 1 [0041.608] GetProcessHeap () returned 0x560000 [0041.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.608] GetProcessHeap () returned 0x560000 [0041.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.609] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned 52 [0041.609] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.609] GetProcessHeap () returned 0x560000 [0041.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.609] GetProcessHeap () returned 0x560000 [0041.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x5894f8 [0041.609] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.609] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.609] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.609] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.609] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.609] GetProcessHeap () returned 0x560000 [0041.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.610] lstrlenA (lpString="010001") returned 6 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584a68 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584b80 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589378 [0041.610] GetProcessHeap () returned 0x560000 [0041.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0041.610] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892d0 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5871d0 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892d0 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.611] GetProcessHeap () returned 0x560000 [0041.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.612] GetProcessHeap () returned 0x560000 [0041.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.613] GetProcessHeap () returned 0x560000 [0041.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.613] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.614] GetProcessHeap () returned 0x560000 [0041.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.615] GetProcessHeap () returned 0x560000 [0041.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589378 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.616] GetProcessHeap () returned 0x560000 [0041.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.616] WriteFile (in: hFile=0x230, lpBuffer=0x5894f8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5894f8*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0041.619] GetProcessHeap () returned 0x560000 [0041.619] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5894f8, Size=0x30) returned 0x5894f8 [0041.619] GetProcessHeap () returned 0x560000 [0041.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.619] GetProcessHeap () returned 0x560000 [0041.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11460) returned 0x59eb30 [0041.621] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x11460, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x11460, lpOverlapped=0x0) returned 1 [0041.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.624] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x11460, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x11460, lpOverlapped=0x0) returned 1 [0041.625] GetProcessHeap () returned 0x560000 [0041.625] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.625] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.625] WriteFile (in: hFile=0x230, lpBuffer=0x5894f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5894f8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.626] CloseHandle (hObject=0x230) returned 1 [0041.628] GetProcessHeap () returned 0x560000 [0041.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0041.628] GetProcessHeap () returned 0x560000 [0041.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.628] GetProcessHeap () returned 0x560000 [0041.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.628] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0041.629] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.badday" [0041.629] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.badday"), dwFlags=0x1) returned 1 [0041.629] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.629] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.629] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.629] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.629] GetProcessHeap () returned 0x560000 [0041.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.629] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0041.629] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2=".") returned 1 [0041.629] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="..") returned 1 [0041.629] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0041.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-ca.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.630] GetProcessHeap () returned 0x560000 [0041.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-ca.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fr-ca.htm", lpUsedDefaultChar=0x0) returned 15 [0041.630] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0041.630] lstrlenA (lpString=".badday") returned 7 [0041.630] lstrlenA (lpString=".badday") returned 7 [0041.630] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0041.630] lstrcmpiA (lpString1="-ca.htm", lpString2=".badday") returned 1 [0041.630] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="how_to_back_files.html") returned -1 [0041.630] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.630] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.630] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.630] GetProcessHeap () returned 0x560000 [0041.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0041.630] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.630] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=69386) returned 1 [0041.630] GetProcessHeap () returned 0x560000 [0041.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.630] GetProcessHeap () returned 0x560000 [0041.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.630] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned 52 [0041.630] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.631] GetProcessHeap () returned 0x560000 [0041.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.631] GetProcessHeap () returned 0x560000 [0041.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x589530 [0041.631] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.631] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.631] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.631] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.631] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.631] GetProcessHeap () returned 0x560000 [0041.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.631] lstrlenA (lpString="010001") returned 6 [0041.631] GetProcessHeap () returned 0x560000 [0041.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0041.631] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584950 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5843d8 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589030 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0041.632] GetProcessHeap () returned 0x560000 [0041.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0041.632] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5890a8 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586720 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5890a8 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586720 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.633] GetProcessHeap () returned 0x560000 [0041.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.634] GetProcessHeap () returned 0x560000 [0041.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.635] GetProcessHeap () returned 0x560000 [0041.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.636] GetProcessHeap () returned 0x560000 [0041.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0041.637] GetProcessHeap () returned 0x560000 [0041.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589030 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.638] GetProcessHeap () returned 0x560000 [0041.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.638] WriteFile (in: hFile=0x230, lpBuffer=0x589530*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589530*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0041.643] GetProcessHeap () returned 0x560000 [0041.643] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589530, Size=0x30) returned 0x589530 [0041.643] GetProcessHeap () returned 0x560000 [0041.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.643] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.643] GetProcessHeap () returned 0x560000 [0041.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10f10) returned 0x59eb30 [0041.643] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x10f10, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x10f10, lpOverlapped=0x0) returned 1 [0041.645] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.645] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x10f10, lpOverlapped=0x0) returned 1 [0041.757] GetProcessHeap () returned 0x560000 [0041.757] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.758] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.758] WriteFile (in: hFile=0x230, lpBuffer=0x589530*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589530*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.760] CloseHandle (hObject=0x230) returned 1 [0041.762] GetProcessHeap () returned 0x560000 [0041.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0041.762] GetProcessHeap () returned 0x560000 [0041.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.762] GetProcessHeap () returned 0x560000 [0041.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.762] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0041.762] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.badday" [0041.762] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.badday"), dwFlags=0x1) returned 1 [0041.763] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.763] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.763] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.763] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.763] GetProcessHeap () returned 0x560000 [0041.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.763] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0041.763] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2=".") returned 1 [0041.763] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="..") returned 1 [0041.763] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-fr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.763] GetProcessHeap () returned 0x560000 [0041.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-fr.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fr-fr.htm", lpUsedDefaultChar=0x0) returned 15 [0041.763] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0041.763] lstrlenA (lpString=".badday") returned 7 [0041.763] lstrlenA (lpString=".badday") returned 7 [0041.764] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0041.764] lstrcmpiA (lpString1="-fr.htm", lpString2=".badday") returned 1 [0041.764] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="how_to_back_files.html") returned -1 [0041.764] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.764] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.764] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.764] GetProcessHeap () returned 0x560000 [0041.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0041.764] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.765] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=69386) returned 1 [0041.765] GetProcessHeap () returned 0x560000 [0041.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.765] GetProcessHeap () returned 0x560000 [0041.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.765] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned 52 [0041.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.765] GetProcessHeap () returned 0x560000 [0041.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.765] GetProcessHeap () returned 0x560000 [0041.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x589568 [0041.765] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.765] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.766] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.766] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.766] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.766] lstrlenA (lpString="010001") returned 6 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584608 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584950 [0041.766] GetProcessHeap () returned 0x560000 [0041.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589348 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589330 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589330 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.767] GetProcessHeap () returned 0x560000 [0041.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.767] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.768] GetProcessHeap () returned 0x560000 [0041.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.768] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.769] GetProcessHeap () returned 0x560000 [0041.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.769] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.770] GetProcessHeap () returned 0x560000 [0041.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.771] GetProcessHeap () returned 0x560000 [0041.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589348 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.772] GetProcessHeap () returned 0x560000 [0041.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.772] WriteFile (in: hFile=0x230, lpBuffer=0x589568*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589568*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0041.794] GetProcessHeap () returned 0x560000 [0041.794] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589568, Size=0x30) returned 0x589568 [0041.794] GetProcessHeap () returned 0x560000 [0041.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.794] GetProcessHeap () returned 0x560000 [0041.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10f10) returned 0x59eb30 [0041.797] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x10f10, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x10f10, lpOverlapped=0x0) returned 1 [0041.799] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.799] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x10f10, lpOverlapped=0x0) returned 1 [0041.801] GetProcessHeap () returned 0x560000 [0041.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.801] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.801] WriteFile (in: hFile=0x230, lpBuffer=0x589568*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589568*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.802] CloseHandle (hObject=0x230) returned 1 [0041.805] GetProcessHeap () returned 0x560000 [0041.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0041.805] GetProcessHeap () returned 0x560000 [0041.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.805] GetProcessHeap () returned 0x560000 [0041.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.805] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0041.805] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.badday" [0041.805] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.badday"), dwFlags=0x1) returned 1 [0041.807] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.807] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.807] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.807] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.807] GetProcessHeap () returned 0x560000 [0041.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.807] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0041.807] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2=".") returned 1 [0041.807] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="..") returned 1 [0041.807] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0041.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_he-il.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.808] GetProcessHeap () returned 0x560000 [0041.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_he-il.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_he-il.htm", lpUsedDefaultChar=0x0) returned 15 [0041.808] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0041.808] lstrlenA (lpString=".badday") returned 7 [0041.808] lstrlenA (lpString=".badday") returned 7 [0041.808] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0041.808] lstrcmpiA (lpString1="-il.htm", lpString2=".badday") returned 1 [0041.808] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="how_to_back_files.html") returned -1 [0041.808] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.808] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.808] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.808] GetProcessHeap () returned 0x560000 [0041.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0041.808] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.809] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=864647) returned 1 [0041.809] GetProcessHeap () returned 0x560000 [0041.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.809] GetProcessHeap () returned 0x560000 [0041.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.809] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned 52 [0041.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.809] GetProcessHeap () returned 0x560000 [0041.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.809] GetProcessHeap () returned 0x560000 [0041.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5895a0 [0041.809] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.809] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.811] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.811] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.811] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.811] lstrlenA (lpString="010001") returned 6 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.811] GetProcessHeap () returned 0x560000 [0041.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0041.811] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5850f8 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589378 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586720 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586720 | out: hHeap=0x560000) returned 1 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589300 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586840 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589300 | out: hHeap=0x560000) returned 1 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.812] GetProcessHeap () returned 0x560000 [0041.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.813] GetProcessHeap () returned 0x560000 [0041.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.813] GetProcessHeap () returned 0x560000 [0041.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.814] GetProcessHeap () returned 0x560000 [0041.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.814] GetProcessHeap () returned 0x560000 [0041.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.815] GetProcessHeap () returned 0x560000 [0041.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.815] GetProcessHeap () returned 0x560000 [0041.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.815] GetProcessHeap () returned 0x560000 [0041.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.815] GetProcessHeap () returned 0x560000 [0041.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.815] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.816] GetProcessHeap () returned 0x560000 [0041.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.817] GetProcessHeap () returned 0x560000 [0041.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589378 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.818] GetProcessHeap () returned 0x560000 [0041.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.818] WriteFile (in: hFile=0x230, lpBuffer=0x5895a0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5895a0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.823] GetProcessHeap () returned 0x560000 [0041.823] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5895a0, Size=0x30) returned 0x5895a0 [0041.823] GetProcessHeap () returned 0x560000 [0041.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.823] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.823] GetProcessHeap () returned 0x560000 [0041.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd3187) returned 0x24b8020 [0041.839] ReadFile (in: hFile=0x230, lpBuffer=0x24b8020, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b8020*, lpNumberOfBytesRead=0x24ad7e8*=0xd3187, lpOverlapped=0x0) returned 1 [0041.853] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.853] WriteFile (in: hFile=0x230, lpBuffer=0x24b8020*, nNumberOfBytesToWrite=0xd3187, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b8020*, lpNumberOfBytesWritten=0x24ad7e4*=0xd3187, lpOverlapped=0x0) returned 1 [0041.858] GetProcessHeap () returned 0x560000 [0041.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b8020 | out: hHeap=0x560000) returned 1 [0041.862] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.862] WriteFile (in: hFile=0x230, lpBuffer=0x5895a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5895a0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.863] CloseHandle (hObject=0x230) returned 1 [0041.876] GetProcessHeap () returned 0x560000 [0041.876] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0041.876] GetProcessHeap () returned 0x560000 [0041.876] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.876] GetProcessHeap () returned 0x560000 [0041.876] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.876] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0041.876] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.badday" [0041.876] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.badday"), dwFlags=0x1) returned 1 [0041.879] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.879] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.879] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.879] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.879] GetProcessHeap () returned 0x560000 [0041.879] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.879] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0041.879] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2=".") returned 1 [0041.879] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="..") returned 1 [0041.879] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0041.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hr-hr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.879] GetProcessHeap () returned 0x560000 [0041.879] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hr-hr.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_hr-hr.htm", lpUsedDefaultChar=0x0) returned 15 [0041.879] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0041.879] lstrlenA (lpString=".badday") returned 7 [0041.879] lstrlenA (lpString=".badday") returned 7 [0041.879] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0041.879] lstrcmpiA (lpString1="-hr.htm", lpString2=".badday") returned 1 [0041.880] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="how_to_back_files.html") returned -1 [0041.880] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.880] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.880] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.880] GetProcessHeap () returned 0x560000 [0041.880] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0041.880] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.880] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=64872) returned 1 [0041.881] GetProcessHeap () returned 0x560000 [0041.881] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.881] GetProcessHeap () returned 0x560000 [0041.881] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.881] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned 52 [0041.881] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.881] GetProcessHeap () returned 0x560000 [0041.881] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.881] GetProcessHeap () returned 0x560000 [0041.881] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5895d8 [0041.881] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.881] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.881] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.882] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.882] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.882] lstrlenA (lpString="010001") returned 6 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584a68 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584720 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589018 [0041.882] GetProcessHeap () returned 0x560000 [0041.882] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0041.882] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589240 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586cc0 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589240 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.883] GetProcessHeap () returned 0x560000 [0041.883] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.884] GetProcessHeap () returned 0x560000 [0041.884] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.884] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.885] GetProcessHeap () returned 0x560000 [0041.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.886] GetProcessHeap () returned 0x560000 [0041.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589018 | out: hHeap=0x560000) returned 1 [0041.887] GetProcessHeap () returned 0x560000 [0041.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.888] GetProcessHeap () returned 0x560000 [0041.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.888] GetProcessHeap () returned 0x560000 [0041.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0041.888] GetProcessHeap () returned 0x560000 [0041.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.888] GetProcessHeap () returned 0x560000 [0041.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.888] GetProcessHeap () returned 0x560000 [0041.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.888] WriteFile (in: hFile=0x230, lpBuffer=0x5895d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5895d8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.892] GetProcessHeap () returned 0x560000 [0041.892] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5895d8, Size=0x30) returned 0x5895d8 [0041.892] GetProcessHeap () returned 0x560000 [0041.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.892] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.892] GetProcessHeap () returned 0x560000 [0041.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfd68) returned 0x59eb30 [0041.892] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0xfd68, lpOverlapped=0x0) returned 1 [0041.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.894] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0xfd68, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0xfd68, lpOverlapped=0x0) returned 1 [0041.895] GetProcessHeap () returned 0x560000 [0041.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.895] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.896] WriteFile (in: hFile=0x230, lpBuffer=0x5895d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5895d8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.896] CloseHandle (hObject=0x230) returned 1 [0041.898] GetProcessHeap () returned 0x560000 [0041.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0041.898] GetProcessHeap () returned 0x560000 [0041.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.899] GetProcessHeap () returned 0x560000 [0041.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.899] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0041.899] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.badday" [0041.899] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.badday"), dwFlags=0x1) returned 1 [0041.899] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.899] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.899] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.899] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.900] GetProcessHeap () returned 0x560000 [0041.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.900] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0041.900] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2=".") returned 1 [0041.900] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="..") returned 1 [0041.900] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0041.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hu-hu.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.900] GetProcessHeap () returned 0x560000 [0041.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hu-hu.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_hu-hu.htm", lpUsedDefaultChar=0x0) returned 15 [0041.900] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0041.900] lstrlenA (lpString=".badday") returned 7 [0041.900] lstrlenA (lpString=".badday") returned 7 [0041.900] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0041.900] lstrcmpiA (lpString1="-hu.htm", lpString2=".badday") returned 1 [0041.900] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="how_to_back_files.html") returned -1 [0041.900] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.900] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.900] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.900] GetProcessHeap () returned 0x560000 [0041.900] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0041.900] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.900] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=84570) returned 1 [0041.900] GetProcessHeap () returned 0x560000 [0041.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.901] GetProcessHeap () returned 0x560000 [0041.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.901] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned 52 [0041.901] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.901] GetProcessHeap () returned 0x560000 [0041.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.901] GetProcessHeap () returned 0x560000 [0041.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x589610 [0041.901] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.901] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.901] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.901] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.901] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.901] GetProcessHeap () returned 0x560000 [0041.901] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.902] lstrlenA (lpString="010001") returned 6 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584a68 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584ec8 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589228 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.902] GetProcessHeap () returned 0x560000 [0041.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0041.902] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891f8 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587260 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891f8 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.903] GetProcessHeap () returned 0x560000 [0041.903] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.904] GetProcessHeap () returned 0x560000 [0041.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.904] GetProcessHeap () returned 0x560000 [0041.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.904] GetProcessHeap () returned 0x560000 [0041.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.904] GetProcessHeap () returned 0x560000 [0041.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.904] GetProcessHeap () returned 0x560000 [0041.904] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.904] GetProcessHeap () returned 0x560000 [0041.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.905] GetProcessHeap () returned 0x560000 [0041.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.906] GetProcessHeap () returned 0x560000 [0041.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.906] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.907] GetProcessHeap () returned 0x560000 [0041.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.907] GetProcessHeap () returned 0x560000 [0041.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589228 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.908] GetProcessHeap () returned 0x560000 [0041.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.908] WriteFile (in: hFile=0x230, lpBuffer=0x589610*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589610*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0041.911] GetProcessHeap () returned 0x560000 [0041.911] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589610, Size=0x30) returned 0x589610 [0041.911] GetProcessHeap () returned 0x560000 [0041.911] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.911] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.911] GetProcessHeap () returned 0x560000 [0041.911] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14a60) returned 0x59eb30 [0041.912] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x14a60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x14a60, lpOverlapped=0x0) returned 1 [0041.913] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.913] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x14a60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x14a60, lpOverlapped=0x0) returned 1 [0041.915] GetProcessHeap () returned 0x560000 [0041.915] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.915] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.915] WriteFile (in: hFile=0x230, lpBuffer=0x589610*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589610*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.915] CloseHandle (hObject=0x230) returned 1 [0041.918] GetProcessHeap () returned 0x560000 [0041.918] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0041.918] GetProcessHeap () returned 0x560000 [0041.918] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.918] GetProcessHeap () returned 0x560000 [0041.918] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.918] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0041.918] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.badday" [0041.918] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.badday"), dwFlags=0x1) returned 1 [0041.919] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.919] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.919] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.919] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.919] GetProcessHeap () returned 0x560000 [0041.919] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.919] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0041.919] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2=".") returned 1 [0041.919] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="..") returned 1 [0041.919] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0041.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_it-it.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.919] GetProcessHeap () returned 0x560000 [0041.919] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_it-it.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_it-it.htm", lpUsedDefaultChar=0x0) returned 15 [0041.919] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0041.919] lstrlenA (lpString=".badday") returned 7 [0041.919] lstrlenA (lpString=".badday") returned 7 [0041.919] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0041.919] lstrcmpiA (lpString1="-it.htm", lpString2=".badday") returned 1 [0041.920] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="how_to_back_files.html") returned -1 [0041.920] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.920] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.920] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.920] GetProcessHeap () returned 0x560000 [0041.920] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0041.920] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.920] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=69485) returned 1 [0041.920] GetProcessHeap () returned 0x560000 [0041.920] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.920] GetProcessHeap () returned 0x560000 [0041.920] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.920] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned 52 [0041.920] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.920] GetProcessHeap () returned 0x560000 [0041.920] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.920] GetProcessHeap () returned 0x560000 [0041.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x589648 [0041.921] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.921] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.921] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.921] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.921] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.921] GetProcessHeap () returned 0x560000 [0041.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.921] lstrlenA (lpString="010001") returned 6 [0041.921] GetProcessHeap () returned 0x560000 [0041.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0041.921] GetProcessHeap () returned 0x560000 [0041.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.921] GetProcessHeap () returned 0x560000 [0041.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0041.921] GetProcessHeap () returned 0x560000 [0041.921] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584950 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584608 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892d0 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589378 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.922] GetProcessHeap () returned 0x560000 [0041.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.922] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586720 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589378 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586720 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.923] GetProcessHeap () returned 0x560000 [0041.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.924] GetProcessHeap () returned 0x560000 [0041.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.924] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.925] GetProcessHeap () returned 0x560000 [0041.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.926] GetProcessHeap () returned 0x560000 [0041.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.926] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892d0 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.927] GetProcessHeap () returned 0x560000 [0041.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.928] WriteFile (in: hFile=0x230, lpBuffer=0x589648*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589648*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0041.934] GetProcessHeap () returned 0x560000 [0041.934] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589648, Size=0x30) returned 0x589648 [0041.934] GetProcessHeap () returned 0x560000 [0041.934] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.934] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.934] GetProcessHeap () returned 0x560000 [0041.934] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10f70) returned 0x59eb30 [0041.934] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x10f70, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x10f70, lpOverlapped=0x0) returned 1 [0041.936] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.936] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x10f70, lpOverlapped=0x0) returned 1 [0041.937] GetProcessHeap () returned 0x560000 [0041.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.939] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.939] WriteFile (in: hFile=0x230, lpBuffer=0x589648*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589648*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.940] CloseHandle (hObject=0x230) returned 1 [0041.942] GetProcessHeap () returned 0x560000 [0041.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0041.942] GetProcessHeap () returned 0x560000 [0041.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.942] GetProcessHeap () returned 0x560000 [0041.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.942] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0041.942] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.badday" [0041.942] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.badday"), dwFlags=0x1) returned 1 [0041.942] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.942] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.943] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.943] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.943] GetProcessHeap () returned 0x560000 [0041.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.943] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0041.943] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2=".") returned 1 [0041.943] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="..") returned 1 [0041.943] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0041.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ja-jp.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.943] GetProcessHeap () returned 0x560000 [0041.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ja-jp.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ja-jp.htm", lpUsedDefaultChar=0x0) returned 15 [0041.943] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0041.943] lstrlenA (lpString=".badday") returned 7 [0041.943] lstrlenA (lpString=".badday") returned 7 [0041.943] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0041.943] lstrcmpiA (lpString1="-jp.htm", lpString2=".badday") returned 1 [0041.943] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="how_to_back_files.html") returned -1 [0041.943] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.943] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.943] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.943] GetProcessHeap () returned 0x560000 [0041.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0041.943] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.944] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=210254) returned 1 [0041.944] GetProcessHeap () returned 0x560000 [0041.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.944] GetProcessHeap () returned 0x560000 [0041.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.944] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned 52 [0041.944] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.944] GetProcessHeap () returned 0x560000 [0041.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.944] GetProcessHeap () returned 0x560000 [0041.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589680 [0041.944] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.944] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.945] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.945] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.945] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.945] lstrlenA (lpString="010001") returned 6 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584838 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5850f8 [0041.945] GetProcessHeap () returned 0x560000 [0041.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589000 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5890a8 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587260 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5890a8 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.946] GetProcessHeap () returned 0x560000 [0041.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.947] GetProcessHeap () returned 0x560000 [0041.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.947] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0041.948] GetProcessHeap () returned 0x560000 [0041.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.948] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.949] GetProcessHeap () returned 0x560000 [0041.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.949] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.950] GetProcessHeap () returned 0x560000 [0041.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.950] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589000 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.951] GetProcessHeap () returned 0x560000 [0041.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.951] WriteFile (in: hFile=0x230, lpBuffer=0x589680*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589680*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.957] GetProcessHeap () returned 0x560000 [0041.957] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589680, Size=0x30) returned 0x589680 [0041.957] GetProcessHeap () returned 0x560000 [0041.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.957] GetProcessHeap () returned 0x560000 [0041.957] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3354e) returned 0x59eb30 [0041.961] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x3354e, lpOverlapped=0x0) returned 1 [0041.965] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.965] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x3354e, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x3354e, lpOverlapped=0x0) returned 1 [0041.968] GetProcessHeap () returned 0x560000 [0041.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0041.968] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.968] WriteFile (in: hFile=0x230, lpBuffer=0x589680*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589680*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0041.968] CloseHandle (hObject=0x230) returned 1 [0041.973] GetProcessHeap () returned 0x560000 [0041.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0041.973] GetProcessHeap () returned 0x560000 [0041.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0041.973] GetProcessHeap () returned 0x560000 [0041.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0041.973] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0041.973] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.badday" [0041.973] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.badday"), dwFlags=0x1) returned 1 [0041.973] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0041.973] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0041.973] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0041.973] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0041.974] GetProcessHeap () returned 0x560000 [0041.974] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0041.974] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0041.974] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2=".") returned 1 [0041.974] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="..") returned 1 [0041.974] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0041.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ko-kr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.974] GetProcessHeap () returned 0x560000 [0041.974] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0041.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ko-kr.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ko-kr.htm", lpUsedDefaultChar=0x0) returned 15 [0041.974] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0041.974] lstrlenA (lpString=".badday") returned 7 [0041.974] lstrlenA (lpString=".badday") returned 7 [0041.974] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0041.974] lstrcmpiA (lpString1="-kr.htm", lpString2=".badday") returned 1 [0041.974] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="how_to_back_files.html") returned -1 [0041.974] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0041.974] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0041.974] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0041.974] GetProcessHeap () returned 0x560000 [0041.974] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0041.974] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0041.975] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=634083) returned 1 [0041.975] GetProcessHeap () returned 0x560000 [0041.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0041.975] GetProcessHeap () returned 0x560000 [0041.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0041.975] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned 52 [0041.975] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0041.975] GetProcessHeap () returned 0x560000 [0041.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0041.975] GetProcessHeap () returned 0x560000 [0041.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5896b8 [0041.976] lstrlenA (lpString="rsa_encrypt") returned 11 [0041.976] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0041.976] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0041.976] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0041.976] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0041.976] GetProcessHeap () returned 0x560000 [0041.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0041.976] lstrlenA (lpString="010001") returned 6 [0041.976] GetProcessHeap () returned 0x560000 [0041.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0041.976] GetProcessHeap () returned 0x560000 [0041.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584b80 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584838 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589300 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0041.977] GetProcessHeap () returned 0x560000 [0041.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.977] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892d0 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586e70 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892d0 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0041.978] GetProcessHeap () returned 0x560000 [0041.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.979] GetProcessHeap () returned 0x560000 [0041.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.979] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.980] GetProcessHeap () returned 0x560000 [0041.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.980] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.981] GetProcessHeap () returned 0x560000 [0041.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0041.982] GetProcessHeap () returned 0x560000 [0041.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589300 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0041.983] GetProcessHeap () returned 0x560000 [0041.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0041.983] WriteFile (in: hFile=0x230, lpBuffer=0x5896b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5896b8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0041.987] GetProcessHeap () returned 0x560000 [0041.987] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5896b8, Size=0x30) returned 0x5896b8 [0041.987] GetProcessHeap () returned 0x560000 [0041.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0041.987] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0041.987] GetProcessHeap () returned 0x560000 [0041.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9ace3) returned 0x24b5020 [0041.999] ReadFile (in: hFile=0x230, lpBuffer=0x24b5020, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b5020*, lpNumberOfBytesRead=0x24ad7e8*=0x9ace3, lpOverlapped=0x0) returned 1 [0042.009] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.009] WriteFile (in: hFile=0x230, lpBuffer=0x24b5020*, nNumberOfBytesToWrite=0x9ace3, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b5020*, lpNumberOfBytesWritten=0x24ad7e4*=0x9ace3, lpOverlapped=0x0) returned 1 [0042.013] GetProcessHeap () returned 0x560000 [0042.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b5020 | out: hHeap=0x560000) returned 1 [0042.016] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.016] WriteFile (in: hFile=0x230, lpBuffer=0x5896b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5896b8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.017] CloseHandle (hObject=0x230) returned 1 [0042.027] GetProcessHeap () returned 0x560000 [0042.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.027] GetProcessHeap () returned 0x560000 [0042.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.027] GetProcessHeap () returned 0x560000 [0042.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.027] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0042.027] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.badday" [0042.027] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.badday"), dwFlags=0x1) returned 1 [0042.028] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.028] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.029] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.029] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.029] GetProcessHeap () returned 0x560000 [0042.029] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.029] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0042.029] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2=".") returned 1 [0042.029] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="..") returned 1 [0042.029] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0042.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lt-lt.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.029] GetProcessHeap () returned 0x560000 [0042.029] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lt-lt.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_lt-lt.htm", lpUsedDefaultChar=0x0) returned 15 [0042.029] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0042.029] lstrlenA (lpString=".badday") returned 7 [0042.029] lstrlenA (lpString=".badday") returned 7 [0042.029] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0042.029] lstrcmpiA (lpString1="-lt.htm", lpString2=".badday") returned 1 [0042.029] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="how_to_back_files.html") returned -1 [0042.029] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.030] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.030] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.030] GetProcessHeap () returned 0x560000 [0042.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d328 [0042.030] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.030] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=76091) returned 1 [0042.030] GetProcessHeap () returned 0x560000 [0042.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.030] GetProcessHeap () returned 0x560000 [0042.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.030] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned 52 [0042.030] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.030] GetProcessHeap () returned 0x560000 [0042.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.030] GetProcessHeap () returned 0x560000 [0042.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5896f0 [0042.030] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.030] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.031] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.031] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.031] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.031] GetProcessHeap () returned 0x560000 [0042.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.031] lstrlenA (lpString="010001") returned 6 [0042.031] GetProcessHeap () returned 0x560000 [0042.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0042.031] GetProcessHeap () returned 0x560000 [0042.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.031] GetProcessHeap () returned 0x560000 [0042.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0042.031] GetProcessHeap () returned 0x560000 [0042.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.031] GetProcessHeap () returned 0x560000 [0042.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584c98 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589390 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589330 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f90 [0042.032] GetProcessHeap () returned 0x560000 [0042.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589330 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.033] GetProcessHeap () returned 0x560000 [0042.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.034] GetProcessHeap () returned 0x560000 [0042.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.035] GetProcessHeap () returned 0x560000 [0042.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.035] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.036] GetProcessHeap () returned 0x560000 [0042.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589390 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.037] GetProcessHeap () returned 0x560000 [0042.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.037] WriteFile (in: hFile=0x230, lpBuffer=0x5896f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5896f0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.042] GetProcessHeap () returned 0x560000 [0042.042] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5896f0, Size=0x30) returned 0x5896f0 [0042.042] GetProcessHeap () returned 0x560000 [0042.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.043] GetProcessHeap () returned 0x560000 [0042.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1293b) returned 0x59eb30 [0042.043] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x1293b, lpOverlapped=0x0) returned 1 [0042.044] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.044] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x1293b, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x1293b, lpOverlapped=0x0) returned 1 [0042.046] GetProcessHeap () returned 0x560000 [0042.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.047] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.047] WriteFile (in: hFile=0x230, lpBuffer=0x5896f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5896f0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.048] CloseHandle (hObject=0x230) returned 1 [0042.050] GetProcessHeap () returned 0x560000 [0042.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0042.050] GetProcessHeap () returned 0x560000 [0042.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.050] GetProcessHeap () returned 0x560000 [0042.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.050] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0042.050] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.badday" [0042.050] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.badday"), dwFlags=0x1) returned 1 [0042.051] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.051] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.051] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.051] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.051] GetProcessHeap () returned 0x560000 [0042.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.051] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0042.051] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2=".") returned 1 [0042.051] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="..") returned 1 [0042.051] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0042.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lv-lv.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.051] GetProcessHeap () returned 0x560000 [0042.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lv-lv.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_lv-lv.htm", lpUsedDefaultChar=0x0) returned 15 [0042.051] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0042.051] lstrlenA (lpString=".badday") returned 7 [0042.051] lstrlenA (lpString=".badday") returned 7 [0042.051] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0042.051] lstrcmpiA (lpString1="-lv.htm", lpString2=".badday") returned 1 [0042.051] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="how_to_back_files.html") returned -1 [0042.051] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.051] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.052] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.052] GetProcessHeap () returned 0x560000 [0042.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.052] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.052] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=83909) returned 1 [0042.052] GetProcessHeap () returned 0x560000 [0042.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.052] GetProcessHeap () returned 0x560000 [0042.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.052] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned 52 [0042.052] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.052] GetProcessHeap () returned 0x560000 [0042.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.052] GetProcessHeap () returned 0x560000 [0042.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x589728 [0042.052] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.052] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.053] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.053] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.053] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.053] lstrlenA (lpString="010001") returned 6 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0042.053] GetProcessHeap () returned 0x560000 [0042.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.053] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584fe0 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x588fd0 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589210 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586ba0 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589210 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0042.054] GetProcessHeap () returned 0x560000 [0042.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.054] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.055] GetProcessHeap () returned 0x560000 [0042.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.056] GetProcessHeap () returned 0x560000 [0042.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.056] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.057] GetProcessHeap () returned 0x560000 [0042.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.058] GetProcessHeap () returned 0x560000 [0042.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x588fd0 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.059] GetProcessHeap () returned 0x560000 [0042.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.059] WriteFile (in: hFile=0x230, lpBuffer=0x589728*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589728*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0042.064] GetProcessHeap () returned 0x560000 [0042.064] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589728, Size=0x30) returned 0x589728 [0042.064] GetProcessHeap () returned 0x560000 [0042.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.064] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.064] GetProcessHeap () returned 0x560000 [0042.064] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x147d0) returned 0x59eb30 [0042.066] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x147d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x147d0, lpOverlapped=0x0) returned 1 [0042.068] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.068] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x147d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x147d0, lpOverlapped=0x0) returned 1 [0042.069] GetProcessHeap () returned 0x560000 [0042.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.069] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.069] WriteFile (in: hFile=0x230, lpBuffer=0x589728*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589728*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.070] CloseHandle (hObject=0x230) returned 1 [0042.072] GetProcessHeap () returned 0x560000 [0042.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.072] GetProcessHeap () returned 0x560000 [0042.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.072] GetProcessHeap () returned 0x560000 [0042.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.072] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0042.072] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.badday" [0042.073] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.badday"), dwFlags=0x1) returned 1 [0042.073] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.073] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.073] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.073] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.073] GetProcessHeap () returned 0x560000 [0042.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.073] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0042.073] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2=".") returned 1 [0042.073] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="..") returned 1 [0042.073] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0042.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nb-no.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.073] GetProcessHeap () returned 0x560000 [0042.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nb-no.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_nb-no.htm", lpUsedDefaultChar=0x0) returned 15 [0042.073] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0042.074] lstrlenA (lpString=".badday") returned 7 [0042.074] lstrlenA (lpString=".badday") returned 7 [0042.074] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0042.074] lstrcmpiA (lpString1="-no.htm", lpString2=".badday") returned 1 [0042.074] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="how_to_back_files.html") returned -1 [0042.074] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.074] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.074] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.074] GetProcessHeap () returned 0x560000 [0042.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0042.074] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.074] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=67188) returned 1 [0042.074] GetProcessHeap () returned 0x560000 [0042.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.074] GetProcessHeap () returned 0x560000 [0042.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.074] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned 52 [0042.074] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.074] GetProcessHeap () returned 0x560000 [0042.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.075] GetProcessHeap () returned 0x560000 [0042.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x589760 [0042.075] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.075] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.075] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.075] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.075] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.075] GetProcessHeap () returned 0x560000 [0042.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.075] lstrlenA (lpString="010001") returned 6 [0042.075] GetProcessHeap () returned 0x560000 [0042.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0042.075] GetProcessHeap () returned 0x560000 [0042.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.075] GetProcessHeap () returned 0x560000 [0042.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0042.075] GetProcessHeap () returned 0x560000 [0042.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584720 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584db0 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589030 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.076] GetProcessHeap () returned 0x560000 [0042.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892b8 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586b10 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892b8 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.077] GetProcessHeap () returned 0x560000 [0042.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.077] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.078] GetProcessHeap () returned 0x560000 [0042.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.079] GetProcessHeap () returned 0x560000 [0042.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.079] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.080] GetProcessHeap () returned 0x560000 [0042.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589030 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0042.081] GetProcessHeap () returned 0x560000 [0042.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0042.082] GetProcessHeap () returned 0x560000 [0042.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0042.082] GetProcessHeap () returned 0x560000 [0042.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.082] GetProcessHeap () returned 0x560000 [0042.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.082] GetProcessHeap () returned 0x560000 [0042.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.082] WriteFile (in: hFile=0x230, lpBuffer=0x589760*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589760*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0042.084] GetProcessHeap () returned 0x560000 [0042.084] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589760, Size=0x30) returned 0x589760 [0042.085] GetProcessHeap () returned 0x560000 [0042.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.085] GetProcessHeap () returned 0x560000 [0042.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10680) returned 0x59eb30 [0042.085] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x10680, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x10680, lpOverlapped=0x0) returned 1 [0042.086] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.086] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x10680, lpOverlapped=0x0) returned 1 [0042.087] GetProcessHeap () returned 0x560000 [0042.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.089] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.089] WriteFile (in: hFile=0x230, lpBuffer=0x589760*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589760*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.089] CloseHandle (hObject=0x230) returned 1 [0042.092] GetProcessHeap () returned 0x560000 [0042.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0042.092] GetProcessHeap () returned 0x560000 [0042.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.092] GetProcessHeap () returned 0x560000 [0042.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.092] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0042.092] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.badday" [0042.092] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.badday"), dwFlags=0x1) returned 1 [0042.092] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.092] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.093] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.093] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.093] GetProcessHeap () returned 0x560000 [0042.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.093] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0042.093] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2=".") returned 1 [0042.093] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="..") returned 1 [0042.093] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0042.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nl-nl.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.093] GetProcessHeap () returned 0x560000 [0042.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nl-nl.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_nl-nl.htm", lpUsedDefaultChar=0x0) returned 15 [0042.093] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0042.093] lstrlenA (lpString=".badday") returned 7 [0042.093] lstrlenA (lpString=".badday") returned 7 [0042.093] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0042.093] lstrcmpiA (lpString1="-nl.htm", lpString2=".badday") returned 1 [0042.093] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="how_to_back_files.html") returned -1 [0042.093] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.093] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.093] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.093] GetProcessHeap () returned 0x560000 [0042.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0042.093] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.094] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=67224) returned 1 [0042.094] GetProcessHeap () returned 0x560000 [0042.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.094] GetProcessHeap () returned 0x560000 [0042.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.094] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned 52 [0042.094] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.094] GetProcessHeap () returned 0x560000 [0042.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.094] GetProcessHeap () returned 0x560000 [0042.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x589798 [0042.095] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.095] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.095] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.095] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.095] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.095] GetProcessHeap () returned 0x560000 [0042.095] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.095] lstrlenA (lpString="010001") returned 6 [0042.095] GetProcessHeap () returned 0x560000 [0042.095] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0042.095] GetProcessHeap () returned 0x560000 [0042.095] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.095] GetProcessHeap () returned 0x560000 [0042.095] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0042.095] GetProcessHeap () returned 0x560000 [0042.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584db0 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5843d8 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589180 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891c8 [0042.096] GetProcessHeap () returned 0x560000 [0042.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586840 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891c8 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.097] GetProcessHeap () returned 0x560000 [0042.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.098] GetProcessHeap () returned 0x560000 [0042.098] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.098] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.099] GetProcessHeap () returned 0x560000 [0042.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.100] GetProcessHeap () returned 0x560000 [0042.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589180 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0042.101] GetProcessHeap () returned 0x560000 [0042.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.102] GetProcessHeap () returned 0x560000 [0042.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0042.102] GetProcessHeap () returned 0x560000 [0042.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.102] GetProcessHeap () returned 0x560000 [0042.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.102] GetProcessHeap () returned 0x560000 [0042.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.102] WriteFile (in: hFile=0x230, lpBuffer=0x589798*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589798*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0042.107] GetProcessHeap () returned 0x560000 [0042.107] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589798, Size=0x30) returned 0x589798 [0042.107] GetProcessHeap () returned 0x560000 [0042.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.107] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.107] GetProcessHeap () returned 0x560000 [0042.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x106a0) returned 0x59eb30 [0042.109] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x106a0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x106a0, lpOverlapped=0x0) returned 1 [0042.110] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.110] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x106a0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x106a0, lpOverlapped=0x0) returned 1 [0042.112] GetProcessHeap () returned 0x560000 [0042.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.112] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.112] WriteFile (in: hFile=0x230, lpBuffer=0x589798*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589798*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.113] CloseHandle (hObject=0x230) returned 1 [0042.115] GetProcessHeap () returned 0x560000 [0042.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0042.115] GetProcessHeap () returned 0x560000 [0042.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.115] GetProcessHeap () returned 0x560000 [0042.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.115] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0042.115] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.badday" [0042.115] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.badday"), dwFlags=0x1) returned 1 [0042.116] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.116] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.116] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.116] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.116] GetProcessHeap () returned 0x560000 [0042.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0042.116] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2=".") returned 1 [0042.116] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="..") returned 1 [0042.116] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0042.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pl-pl.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.116] GetProcessHeap () returned 0x560000 [0042.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pl-pl.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pl-pl.htm", lpUsedDefaultChar=0x0) returned 15 [0042.116] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0042.117] lstrlenA (lpString=".badday") returned 7 [0042.117] lstrlenA (lpString=".badday") returned 7 [0042.117] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0042.117] lstrcmpiA (lpString1="-pl.htm", lpString2=".badday") returned 1 [0042.117] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="how_to_back_files.html") returned -1 [0042.117] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.117] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.117] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.117] GetProcessHeap () returned 0x560000 [0042.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.117] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.117] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81812) returned 1 [0042.117] GetProcessHeap () returned 0x560000 [0042.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.117] GetProcessHeap () returned 0x560000 [0042.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.117] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned 52 [0042.117] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.117] GetProcessHeap () returned 0x560000 [0042.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.118] GetProcessHeap () returned 0x560000 [0042.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5897d0 [0042.118] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.118] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.118] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.118] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.118] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.118] GetProcessHeap () returned 0x560000 [0042.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.118] lstrlenA (lpString="010001") returned 6 [0042.118] GetProcessHeap () returned 0x560000 [0042.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0042.118] GetProcessHeap () returned 0x560000 [0042.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584608 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584a68 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891b0 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.119] GetProcessHeap () returned 0x560000 [0042.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589000 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589000 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.120] GetProcessHeap () returned 0x560000 [0042.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.120] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.121] GetProcessHeap () returned 0x560000 [0042.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.121] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.122] GetProcessHeap () returned 0x560000 [0042.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.122] GetProcessHeap () returned 0x560000 [0042.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.123] GetProcessHeap () returned 0x560000 [0042.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.123] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.124] GetProcessHeap () returned 0x560000 [0042.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.124] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891b0 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.125] GetProcessHeap () returned 0x560000 [0042.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.125] WriteFile (in: hFile=0x230, lpBuffer=0x5897d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5897d0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.129] GetProcessHeap () returned 0x560000 [0042.129] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5897d0, Size=0x30) returned 0x5897d0 [0042.129] GetProcessHeap () returned 0x560000 [0042.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.129] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.129] GetProcessHeap () returned 0x560000 [0042.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13f94) returned 0x59eb30 [0042.129] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x13f94, lpOverlapped=0x0) returned 1 [0042.130] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.130] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x13f94, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x13f94, lpOverlapped=0x0) returned 1 [0042.132] GetProcessHeap () returned 0x560000 [0042.132] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.133] WriteFile (in: hFile=0x230, lpBuffer=0x5897d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5897d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.134] CloseHandle (hObject=0x230) returned 1 [0042.136] GetProcessHeap () returned 0x560000 [0042.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.136] GetProcessHeap () returned 0x560000 [0042.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.136] GetProcessHeap () returned 0x560000 [0042.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.136] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0042.136] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.badday" [0042.136] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.badday"), dwFlags=0x1) returned 1 [0042.137] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.137] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.137] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.137] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.137] GetProcessHeap () returned 0x560000 [0042.137] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.137] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0042.137] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2=".") returned 1 [0042.137] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="..") returned 1 [0042.137] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pt-br.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0042.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-br.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.137] GetProcessHeap () returned 0x560000 [0042.137] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-br.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pt-br.htm", lpUsedDefaultChar=0x0) returned 15 [0042.137] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0042.138] lstrlenA (lpString=".badday") returned 7 [0042.138] lstrlenA (lpString=".badday") returned 7 [0042.138] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0042.138] lstrcmpiA (lpString1="-br.htm", lpString2=".badday") returned 1 [0042.138] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="how_to_back_files.html") returned -1 [0042.138] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.138] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.138] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.138] GetProcessHeap () returned 0x560000 [0042.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0042.138] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.138] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=68292) returned 1 [0042.138] GetProcessHeap () returned 0x560000 [0042.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.138] GetProcessHeap () returned 0x560000 [0042.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.138] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned 52 [0042.138] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.139] GetProcessHeap () returned 0x560000 [0042.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.139] GetProcessHeap () returned 0x560000 [0042.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x589808 [0042.139] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.139] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.139] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.139] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.139] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.139] GetProcessHeap () returned 0x560000 [0042.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.139] lstrlenA (lpString="010001") returned 6 [0042.139] GetProcessHeap () returned 0x560000 [0042.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0042.139] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584950 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584b80 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589030 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0042.140] GetProcessHeap () returned 0x560000 [0042.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589060 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586600 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589060 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.141] GetProcessHeap () returned 0x560000 [0042.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.142] GetProcessHeap () returned 0x560000 [0042.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.143] GetProcessHeap () returned 0x560000 [0042.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.144] GetProcessHeap () returned 0x560000 [0042.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.144] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589030 | out: hHeap=0x560000) returned 1 [0042.145] GetProcessHeap () returned 0x560000 [0042.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0042.146] GetProcessHeap () returned 0x560000 [0042.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.146] GetProcessHeap () returned 0x560000 [0042.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0042.146] GetProcessHeap () returned 0x560000 [0042.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.146] GetProcessHeap () returned 0x560000 [0042.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.146] GetProcessHeap () returned 0x560000 [0042.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.146] WriteFile (in: hFile=0x230, lpBuffer=0x589808*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589808*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0042.149] GetProcessHeap () returned 0x560000 [0042.149] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589808, Size=0x30) returned 0x589808 [0042.149] GetProcessHeap () returned 0x560000 [0042.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.150] GetProcessHeap () returned 0x560000 [0042.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10ad0) returned 0x59eb30 [0042.151] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x10ad0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x10ad0, lpOverlapped=0x0) returned 1 [0042.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.153] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x10ad0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x10ad0, lpOverlapped=0x0) returned 1 [0042.154] GetProcessHeap () returned 0x560000 [0042.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.154] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.154] WriteFile (in: hFile=0x230, lpBuffer=0x589808*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589808*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.155] CloseHandle (hObject=0x230) returned 1 [0042.157] GetProcessHeap () returned 0x560000 [0042.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0042.157] GetProcessHeap () returned 0x560000 [0042.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.157] GetProcessHeap () returned 0x560000 [0042.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.158] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0042.158] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.badday" [0042.158] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.badday"), dwFlags=0x1) returned 1 [0042.158] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.158] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.158] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.158] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.158] GetProcessHeap () returned 0x560000 [0042.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.158] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0042.158] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2=".") returned 1 [0042.158] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="..") returned 1 [0042.158] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0042.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-pt.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.159] GetProcessHeap () returned 0x560000 [0042.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-pt.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pt-pt.htm", lpUsedDefaultChar=0x0) returned 15 [0042.159] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0042.159] lstrlenA (lpString=".badday") returned 7 [0042.159] lstrlenA (lpString=".badday") returned 7 [0042.159] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0042.159] lstrcmpiA (lpString1="-pt.htm", lpString2=".badday") returned 1 [0042.159] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="how_to_back_files.html") returned -1 [0042.159] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.159] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.159] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.159] GetProcessHeap () returned 0x560000 [0042.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0042.159] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.159] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=71054) returned 1 [0042.159] GetProcessHeap () returned 0x560000 [0042.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.159] GetProcessHeap () returned 0x560000 [0042.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.159] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned 52 [0042.159] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.159] GetProcessHeap () returned 0x560000 [0042.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.160] GetProcessHeap () returned 0x560000 [0042.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x589840 [0042.160] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.160] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.160] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.160] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.160] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.160] GetProcessHeap () returned 0x560000 [0042.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.160] lstrlenA (lpString="010001") returned 6 [0042.160] GetProcessHeap () returned 0x560000 [0042.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0042.160] GetProcessHeap () returned 0x560000 [0042.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5843d8 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589348 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0042.161] GetProcessHeap () returned 0x560000 [0042.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589360 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587530 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589360 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.162] GetProcessHeap () returned 0x560000 [0042.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.163] GetProcessHeap () returned 0x560000 [0042.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.164] GetProcessHeap () returned 0x560000 [0042.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.164] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.165] GetProcessHeap () returned 0x560000 [0042.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589348 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0042.166] GetProcessHeap () returned 0x560000 [0042.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.167] GetProcessHeap () returned 0x560000 [0042.167] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.167] GetProcessHeap () returned 0x560000 [0042.167] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.167] WriteFile (in: hFile=0x230, lpBuffer=0x589840*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589840*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0042.170] GetProcessHeap () returned 0x560000 [0042.170] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589840, Size=0x30) returned 0x589840 [0042.170] GetProcessHeap () returned 0x560000 [0042.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.170] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.170] GetProcessHeap () returned 0x560000 [0042.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11590) returned 0x59eb30 [0042.170] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x11590, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x11590, lpOverlapped=0x0) returned 1 [0042.171] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.171] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x11590, lpOverlapped=0x0) returned 1 [0042.173] GetProcessHeap () returned 0x560000 [0042.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.174] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.174] WriteFile (in: hFile=0x230, lpBuffer=0x589840*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589840*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.175] CloseHandle (hObject=0x230) returned 1 [0042.177] GetProcessHeap () returned 0x560000 [0042.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0042.177] GetProcessHeap () returned 0x560000 [0042.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.177] GetProcessHeap () returned 0x560000 [0042.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.177] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0042.177] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.badday" [0042.177] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.badday"), dwFlags=0x1) returned 1 [0042.178] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.178] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.178] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.178] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.178] GetProcessHeap () returned 0x560000 [0042.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.178] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0042.178] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2=".") returned 1 [0042.178] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="..") returned 1 [0042.178] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0042.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ro-ro.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.178] GetProcessHeap () returned 0x560000 [0042.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ro-ro.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ro-ro.htm", lpUsedDefaultChar=0x0) returned 15 [0042.178] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0042.178] lstrlenA (lpString=".badday") returned 7 [0042.178] lstrlenA (lpString=".badday") returned 7 [0042.178] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0042.178] lstrcmpiA (lpString1="-ro.htm", lpString2=".badday") returned 1 [0042.178] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="how_to_back_files.html") returned -1 [0042.178] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.178] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.179] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.179] GetProcessHeap () returned 0x560000 [0042.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.179] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.182] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=78176) returned 1 [0042.182] GetProcessHeap () returned 0x560000 [0042.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.182] GetProcessHeap () returned 0x560000 [0042.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.182] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned 52 [0042.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.182] GetProcessHeap () returned 0x560000 [0042.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.182] GetProcessHeap () returned 0x560000 [0042.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589878 [0042.182] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.182] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.183] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.183] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.183] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.183] lstrlenA (lpString="010001") returned 6 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584ec8 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0042.183] GetProcessHeap () returned 0x560000 [0042.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584db0 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891e0 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589048 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587140 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589048 | out: hHeap=0x560000) returned 1 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.184] GetProcessHeap () returned 0x560000 [0042.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.185] GetProcessHeap () returned 0x560000 [0042.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.185] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.186] GetProcessHeap () returned 0x560000 [0042.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.187] GetProcessHeap () returned 0x560000 [0042.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.187] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.188] GetProcessHeap () returned 0x560000 [0042.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.188] GetProcessHeap () returned 0x560000 [0042.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891e0 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0042.189] GetProcessHeap () returned 0x560000 [0042.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.190] GetProcessHeap () returned 0x560000 [0042.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0042.190] GetProcessHeap () returned 0x560000 [0042.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.190] GetProcessHeap () returned 0x560000 [0042.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.190] GetProcessHeap () returned 0x560000 [0042.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.190] WriteFile (in: hFile=0x230, lpBuffer=0x589878*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589878*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.196] GetProcessHeap () returned 0x560000 [0042.196] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589878, Size=0x30) returned 0x589878 [0042.196] GetProcessHeap () returned 0x560000 [0042.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.196] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.197] GetProcessHeap () returned 0x560000 [0042.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13160) returned 0x59eb30 [0042.199] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x13160, lpOverlapped=0x0) returned 1 [0042.201] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.201] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x13160, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x13160, lpOverlapped=0x0) returned 1 [0042.203] GetProcessHeap () returned 0x560000 [0042.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.204] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.204] WriteFile (in: hFile=0x230, lpBuffer=0x589878*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589878*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.205] CloseHandle (hObject=0x230) returned 1 [0042.207] GetProcessHeap () returned 0x560000 [0042.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.207] GetProcessHeap () returned 0x560000 [0042.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.207] GetProcessHeap () returned 0x560000 [0042.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.208] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0042.208] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.badday" [0042.208] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.badday"), dwFlags=0x1) returned 1 [0042.208] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.208] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.208] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.208] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.208] GetProcessHeap () returned 0x560000 [0042.208] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.208] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0042.208] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2=".") returned 1 [0042.208] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="..") returned 1 [0042.208] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ru-ru.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0042.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ru-ru.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.209] GetProcessHeap () returned 0x560000 [0042.209] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ru-ru.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ru-ru.htm", lpUsedDefaultChar=0x0) returned 15 [0042.209] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0042.209] lstrlenA (lpString=".badday") returned 7 [0042.209] lstrlenA (lpString=".badday") returned 7 [0042.209] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0042.209] lstrcmpiA (lpString1="-ru.htm", lpString2=".badday") returned 1 [0042.209] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="how_to_back_files.html") returned -1 [0042.209] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.209] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.209] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.209] GetProcessHeap () returned 0x560000 [0042.209] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0042.209] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.209] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=283852) returned 1 [0042.209] GetProcessHeap () returned 0x560000 [0042.209] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.209] GetProcessHeap () returned 0x560000 [0042.209] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.209] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned 52 [0042.210] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.210] GetProcessHeap () returned 0x560000 [0042.210] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.210] GetProcessHeap () returned 0x560000 [0042.210] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x5898b0 [0042.210] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.210] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.210] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.210] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.210] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.210] GetProcessHeap () returned 0x560000 [0042.210] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.210] lstrlenA (lpString="010001") returned 6 [0042.210] GetProcessHeap () returned 0x560000 [0042.210] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5843d8 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892b8 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586720 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.211] GetProcessHeap () returned 0x560000 [0042.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586720 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589138 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5870b0 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589138 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.212] GetProcessHeap () returned 0x560000 [0042.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.212] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.213] GetProcessHeap () returned 0x560000 [0042.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.213] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.214] GetProcessHeap () returned 0x560000 [0042.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.215] GetProcessHeap () returned 0x560000 [0042.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.215] GetProcessHeap () returned 0x560000 [0042.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.216] GetProcessHeap () returned 0x560000 [0042.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.217] GetProcessHeap () returned 0x560000 [0042.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.217] GetProcessHeap () returned 0x560000 [0042.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.217] GetProcessHeap () returned 0x560000 [0042.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892b8 | out: hHeap=0x560000) returned 1 [0042.217] GetProcessHeap () returned 0x560000 [0042.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0042.218] GetProcessHeap () returned 0x560000 [0042.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.218] GetProcessHeap () returned 0x560000 [0042.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0042.218] GetProcessHeap () returned 0x560000 [0042.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.218] GetProcessHeap () returned 0x560000 [0042.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.218] GetProcessHeap () returned 0x560000 [0042.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.218] WriteFile (in: hFile=0x230, lpBuffer=0x5898b0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5898b0*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0042.221] GetProcessHeap () returned 0x560000 [0042.221] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5898b0, Size=0x30) returned 0x5898b0 [0042.221] GetProcessHeap () returned 0x560000 [0042.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.221] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.221] GetProcessHeap () returned 0x560000 [0042.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x454d0) returned 0x59eb30 [0042.224] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x454d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x454d0, lpOverlapped=0x0) returned 1 [0042.237] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.237] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x454d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x454d0, lpOverlapped=0x0) returned 1 [0042.239] GetProcessHeap () returned 0x560000 [0042.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.239] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.239] WriteFile (in: hFile=0x230, lpBuffer=0x5898b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5898b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.240] CloseHandle (hObject=0x230) returned 1 [0042.246] GetProcessHeap () returned 0x560000 [0042.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0042.246] GetProcessHeap () returned 0x560000 [0042.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.246] GetProcessHeap () returned 0x560000 [0042.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.246] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0042.246] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.badday" [0042.246] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.badday"), dwFlags=0x1) returned 1 [0042.247] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.247] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.247] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.247] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.247] GetProcessHeap () returned 0x560000 [0042.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.247] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0042.247] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2=".") returned 1 [0042.247] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="..") returned 1 [0042.247] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0042.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sk-sk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.247] GetProcessHeap () returned 0x560000 [0042.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sk-sk.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sk-sk.htm", lpUsedDefaultChar=0x0) returned 15 [0042.247] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0042.248] lstrlenA (lpString=".badday") returned 7 [0042.248] lstrlenA (lpString=".badday") returned 7 [0042.248] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0042.248] lstrcmpiA (lpString1="-sk.htm", lpString2=".badday") returned 1 [0042.248] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="how_to_back_files.html") returned -1 [0042.248] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.248] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.248] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.248] GetProcessHeap () returned 0x560000 [0042.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0042.248] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.249] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81953) returned 1 [0042.249] GetProcessHeap () returned 0x560000 [0042.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.249] GetProcessHeap () returned 0x560000 [0042.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.249] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned 52 [0042.249] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.249] GetProcessHeap () returned 0x560000 [0042.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.249] GetProcessHeap () returned 0x560000 [0042.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x5898e8 [0042.249] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.249] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.250] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.250] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.250] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.250] lstrlenA (lpString="010001") returned 6 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584b80 [0042.250] GetProcessHeap () returned 0x560000 [0042.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.250] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589378 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589348 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5868d0 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589348 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.251] GetProcessHeap () returned 0x560000 [0042.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.251] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.252] GetProcessHeap () returned 0x560000 [0042.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.253] GetProcessHeap () returned 0x560000 [0042.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.254] GetProcessHeap () returned 0x560000 [0042.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.255] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589378 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.256] GetProcessHeap () returned 0x560000 [0042.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.256] WriteFile (in: hFile=0x230, lpBuffer=0x5898e8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5898e8*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0042.330] GetProcessHeap () returned 0x560000 [0042.330] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5898e8, Size=0x30) returned 0x5898e8 [0042.330] GetProcessHeap () returned 0x560000 [0042.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.330] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.330] GetProcessHeap () returned 0x560000 [0042.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14030) returned 0x59eb30 [0042.330] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x14030, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x14030, lpOverlapped=0x0) returned 1 [0042.332] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.332] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x14030, lpOverlapped=0x0) returned 1 [0042.333] GetProcessHeap () returned 0x560000 [0042.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.335] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.335] WriteFile (in: hFile=0x230, lpBuffer=0x5898e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5898e8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.336] CloseHandle (hObject=0x230) returned 1 [0042.338] GetProcessHeap () returned 0x560000 [0042.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0042.338] GetProcessHeap () returned 0x560000 [0042.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.338] GetProcessHeap () returned 0x560000 [0042.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.338] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0042.338] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.badday" [0042.339] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.badday"), dwFlags=0x1) returned 1 [0042.339] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.339] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.339] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.339] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.339] GetProcessHeap () returned 0x560000 [0042.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.339] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0042.339] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2=".") returned 1 [0042.339] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="..") returned 1 [0042.339] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0042.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sl-si.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.340] GetProcessHeap () returned 0x560000 [0042.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sl-si.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sl-si.htm", lpUsedDefaultChar=0x0) returned 15 [0042.340] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0042.340] lstrlenA (lpString=".badday") returned 7 [0042.340] lstrlenA (lpString=".badday") returned 7 [0042.340] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0042.340] lstrcmpiA (lpString1="-si.htm", lpString2=".badday") returned 1 [0042.340] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="how_to_back_files.html") returned -1 [0042.340] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.340] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.340] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.340] GetProcessHeap () returned 0x560000 [0042.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.340] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.340] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=66159) returned 1 [0042.340] GetProcessHeap () returned 0x560000 [0042.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.340] GetProcessHeap () returned 0x560000 [0042.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.340] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned 52 [0042.341] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.341] GetProcessHeap () returned 0x560000 [0042.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.341] GetProcessHeap () returned 0x560000 [0042.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x589920 [0042.341] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.341] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.341] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.341] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.342] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.342] GetProcessHeap () returned 0x560000 [0042.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.342] lstrlenA (lpString="010001") returned 6 [0042.342] GetProcessHeap () returned 0x560000 [0042.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0042.342] GetProcessHeap () returned 0x560000 [0042.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.342] GetProcessHeap () returned 0x560000 [0042.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0042.342] GetProcessHeap () returned 0x560000 [0042.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.342] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584b80 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584c98 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589390 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589318 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.343] GetProcessHeap () returned 0x560000 [0042.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586c30 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589318 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.344] GetProcessHeap () returned 0x560000 [0042.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.344] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.345] GetProcessHeap () returned 0x560000 [0042.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.345] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.346] GetProcessHeap () returned 0x560000 [0042.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.347] GetProcessHeap () returned 0x560000 [0042.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589390 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0042.348] GetProcessHeap () returned 0x560000 [0042.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.349] GetProcessHeap () returned 0x560000 [0042.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0042.349] GetProcessHeap () returned 0x560000 [0042.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.349] GetProcessHeap () returned 0x560000 [0042.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.349] GetProcessHeap () returned 0x560000 [0042.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.349] WriteFile (in: hFile=0x230, lpBuffer=0x589920*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589920*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0042.352] GetProcessHeap () returned 0x560000 [0042.352] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589920, Size=0x30) returned 0x589920 [0042.352] GetProcessHeap () returned 0x560000 [0042.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.352] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.352] GetProcessHeap () returned 0x560000 [0042.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10270) returned 0x59eb30 [0042.354] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x10270, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x10270, lpOverlapped=0x0) returned 1 [0042.356] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.356] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x10270, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x10270, lpOverlapped=0x0) returned 1 [0042.357] GetProcessHeap () returned 0x560000 [0042.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.358] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.358] WriteFile (in: hFile=0x230, lpBuffer=0x589920*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589920*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.359] CloseHandle (hObject=0x230) returned 1 [0042.361] GetProcessHeap () returned 0x560000 [0042.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.361] GetProcessHeap () returned 0x560000 [0042.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.362] GetProcessHeap () returned 0x560000 [0042.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.362] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0042.362] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.badday" [0042.362] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.badday"), dwFlags=0x1) returned 1 [0042.362] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.362] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.362] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.362] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.362] GetProcessHeap () returned 0x560000 [0042.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.362] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0042.362] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2=".") returned 1 [0042.363] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="..") returned 1 [0042.363] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0042.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sr-latn-cs.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0042.363] GetProcessHeap () returned 0x560000 [0042.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576b18 [0042.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sr-latn-cs.htm", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sr-latn-cs.htm", lpUsedDefaultChar=0x0) returned 20 [0042.363] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0042.363] lstrlenA (lpString=".badday") returned 7 [0042.363] lstrlenA (lpString=".badday") returned 7 [0042.363] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0042.363] lstrcmpiA (lpString1="-cs.htm", lpString2=".badday") returned 1 [0042.363] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="how_to_back_files.html") returned -1 [0042.363] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.363] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.363] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.363] GetProcessHeap () returned 0x560000 [0042.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.363] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.364] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=75552) returned 1 [0042.364] GetProcessHeap () returned 0x560000 [0042.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.364] GetProcessHeap () returned 0x560000 [0042.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.364] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned 57 [0042.364] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.364] GetProcessHeap () returned 0x560000 [0042.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.364] GetProcessHeap () returned 0x560000 [0042.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589958 [0042.365] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.365] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.365] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.365] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.365] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.365] GetProcessHeap () returned 0x560000 [0042.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.365] lstrlenA (lpString="010001") returned 6 [0042.365] GetProcessHeap () returned 0x560000 [0042.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0042.365] GetProcessHeap () returned 0x560000 [0042.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.365] GetProcessHeap () returned 0x560000 [0042.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0042.365] GetProcessHeap () returned 0x560000 [0042.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584ec8 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584db0 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5844f0 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589300 [0042.366] GetProcessHeap () returned 0x560000 [0042.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.366] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587020 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589300 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587020 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.367] GetProcessHeap () returned 0x560000 [0042.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.367] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.368] GetProcessHeap () returned 0x560000 [0042.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.368] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.369] GetProcessHeap () returned 0x560000 [0042.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.369] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.370] GetProcessHeap () returned 0x560000 [0042.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.370] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.371] GetProcessHeap () returned 0x560000 [0042.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0042.372] GetProcessHeap () returned 0x560000 [0042.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.372] GetProcessHeap () returned 0x560000 [0042.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0042.372] GetProcessHeap () returned 0x560000 [0042.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.372] GetProcessHeap () returned 0x560000 [0042.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.372] GetProcessHeap () returned 0x560000 [0042.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.372] WriteFile (in: hFile=0x230, lpBuffer=0x589958*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589958*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.375] GetProcessHeap () returned 0x560000 [0042.375] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589958, Size=0x30) returned 0x589958 [0042.375] GetProcessHeap () returned 0x560000 [0042.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.375] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.375] GetProcessHeap () returned 0x560000 [0042.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12720) returned 0x59eb30 [0042.378] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x12720, lpOverlapped=0x0) returned 1 [0042.379] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.379] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x12720, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x12720, lpOverlapped=0x0) returned 1 [0042.382] GetProcessHeap () returned 0x560000 [0042.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.382] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.382] WriteFile (in: hFile=0x230, lpBuffer=0x589958*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589958*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.383] CloseHandle (hObject=0x230) returned 1 [0042.385] GetProcessHeap () returned 0x560000 [0042.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.385] GetProcessHeap () returned 0x560000 [0042.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.385] GetProcessHeap () returned 0x560000 [0042.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.385] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0042.385] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.badday" [0042.385] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.badday"), dwFlags=0x1) returned 1 [0042.386] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.386] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.386] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.386] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.386] GetProcessHeap () returned 0x560000 [0042.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b18 | out: hHeap=0x560000) returned 1 [0042.386] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0042.386] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2=".") returned 1 [0042.386] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="..") returned 1 [0042.386] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0042.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sv-se.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.386] GetProcessHeap () returned 0x560000 [0042.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sv-se.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sv-se.htm", lpUsedDefaultChar=0x0) returned 15 [0042.386] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0042.386] lstrlenA (lpString=".badday") returned 7 [0042.386] lstrlenA (lpString=".badday") returned 7 [0042.386] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0042.387] lstrcmpiA (lpString1="-se.htm", lpString2=".badday") returned 1 [0042.387] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="how_to_back_files.html") returned -1 [0042.387] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.387] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.387] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.387] GetProcessHeap () returned 0x560000 [0042.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.387] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.387] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=70391) returned 1 [0042.387] GetProcessHeap () returned 0x560000 [0042.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.387] GetProcessHeap () returned 0x560000 [0042.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.387] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned 52 [0042.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.387] GetProcessHeap () returned 0x560000 [0042.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.387] GetProcessHeap () returned 0x560000 [0042.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x589990 [0042.387] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.387] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.388] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.388] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.388] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.388] GetProcessHeap () returned 0x560000 [0042.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.388] lstrlenA (lpString="010001") returned 6 [0042.388] GetProcessHeap () returned 0x560000 [0042.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584838 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584ec8 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589150 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0042.389] GetProcessHeap () returned 0x560000 [0042.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891b0 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587410 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891b0 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5843d8 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.390] GetProcessHeap () returned 0x560000 [0042.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.390] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.391] GetProcessHeap () returned 0x560000 [0042.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.391] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.392] GetProcessHeap () returned 0x560000 [0042.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.393] GetProcessHeap () returned 0x560000 [0042.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.393] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.394] GetProcessHeap () returned 0x560000 [0042.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589150 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.395] GetProcessHeap () returned 0x560000 [0042.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.395] WriteFile (in: hFile=0x230, lpBuffer=0x589990*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589990*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0042.399] GetProcessHeap () returned 0x560000 [0042.399] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589990, Size=0x30) returned 0x589990 [0042.399] GetProcessHeap () returned 0x560000 [0042.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.399] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.399] GetProcessHeap () returned 0x560000 [0042.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11300) returned 0x59eb30 [0042.399] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x11300, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x11300, lpOverlapped=0x0) returned 1 [0042.401] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.401] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x11300, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x11300, lpOverlapped=0x0) returned 1 [0042.402] GetProcessHeap () returned 0x560000 [0042.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.403] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.403] WriteFile (in: hFile=0x230, lpBuffer=0x589990*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589990*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.405] CloseHandle (hObject=0x230) returned 1 [0042.407] GetProcessHeap () returned 0x560000 [0042.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.407] GetProcessHeap () returned 0x560000 [0042.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.407] GetProcessHeap () returned 0x560000 [0042.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.407] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0042.407] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.badday" [0042.407] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.badday"), dwFlags=0x1) returned 1 [0042.407] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.407] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.408] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.408] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.408] GetProcessHeap () returned 0x560000 [0042.408] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.408] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0042.408] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2=".") returned 1 [0042.408] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="..") returned 1 [0042.408] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0042.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_th-th.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.408] GetProcessHeap () returned 0x560000 [0042.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_th-th.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_th-th.htm", lpUsedDefaultChar=0x0) returned 15 [0042.408] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0042.408] lstrlenA (lpString=".badday") returned 7 [0042.408] lstrlenA (lpString=".badday") returned 7 [0042.408] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0042.408] lstrcmpiA (lpString1="-th.htm", lpString2=".badday") returned 1 [0042.408] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="how_to_back_files.html") returned -1 [0042.408] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.408] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.408] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.408] GetProcessHeap () returned 0x560000 [0042.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.408] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.409] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=254145) returned 1 [0042.409] GetProcessHeap () returned 0x560000 [0042.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.409] GetProcessHeap () returned 0x560000 [0042.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.409] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned 52 [0042.409] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.409] GetProcessHeap () returned 0x560000 [0042.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.409] GetProcessHeap () returned 0x560000 [0042.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5899c8 [0042.409] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.409] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.410] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.410] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.410] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.410] lstrlenA (lpString="010001") returned 6 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584838 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.410] GetProcessHeap () returned 0x560000 [0042.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584a68 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589120 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589258 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589258 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c98 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.411] GetProcessHeap () returned 0x560000 [0042.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.411] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.412] GetProcessHeap () returned 0x560000 [0042.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.413] GetProcessHeap () returned 0x560000 [0042.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.413] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.414] GetProcessHeap () returned 0x560000 [0042.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.414] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.415] GetProcessHeap () returned 0x560000 [0042.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589120 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.416] GetProcessHeap () returned 0x560000 [0042.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.416] WriteFile (in: hFile=0x230, lpBuffer=0x5899c8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5899c8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.420] GetProcessHeap () returned 0x560000 [0042.420] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5899c8, Size=0x30) returned 0x5899c8 [0042.420] GetProcessHeap () returned 0x560000 [0042.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.420] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.420] GetProcessHeap () returned 0x560000 [0042.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3e0c1) returned 0x59eb30 [0042.425] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x3e0c1, lpOverlapped=0x0) returned 1 [0042.429] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.429] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x3e0c1, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x3e0c1, lpOverlapped=0x0) returned 1 [0042.433] GetProcessHeap () returned 0x560000 [0042.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.433] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.433] WriteFile (in: hFile=0x230, lpBuffer=0x5899c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5899c8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.434] CloseHandle (hObject=0x230) returned 1 [0042.439] GetProcessHeap () returned 0x560000 [0042.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.439] GetProcessHeap () returned 0x560000 [0042.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.440] GetProcessHeap () returned 0x560000 [0042.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.440] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0042.440] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.badday" [0042.440] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.badday"), dwFlags=0x1) returned 1 [0042.440] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.440] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.440] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.440] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.440] GetProcessHeap () returned 0x560000 [0042.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.440] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0042.441] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2=".") returned 1 [0042.441] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="..") returned 1 [0042.441] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0042.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_tr-tr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.441] GetProcessHeap () returned 0x560000 [0042.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_tr-tr.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_tr-tr.htm", lpUsedDefaultChar=0x0) returned 15 [0042.441] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0042.441] lstrlenA (lpString=".badday") returned 7 [0042.441] lstrlenA (lpString=".badday") returned 7 [0042.441] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0042.441] lstrcmpiA (lpString1="-tr.htm", lpString2=".badday") returned 1 [0042.441] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="how_to_back_files.html") returned -1 [0042.441] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.441] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.441] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.441] GetProcessHeap () returned 0x560000 [0042.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0042.441] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.441] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=75137) returned 1 [0042.442] GetProcessHeap () returned 0x560000 [0042.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.442] GetProcessHeap () returned 0x560000 [0042.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.442] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned 52 [0042.442] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.442] GetProcessHeap () returned 0x560000 [0042.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.442] GetProcessHeap () returned 0x560000 [0042.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589a00 [0042.442] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.442] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.442] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.442] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.443] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.443] lstrlenA (lpString="010001") returned 6 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5843d8 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584c98 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5890c0 [0042.443] GetProcessHeap () returned 0x560000 [0042.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589150 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f00 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589150 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.444] GetProcessHeap () returned 0x560000 [0042.444] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.444] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.445] GetProcessHeap () returned 0x560000 [0042.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.445] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.446] GetProcessHeap () returned 0x560000 [0042.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.446] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.447] GetProcessHeap () returned 0x560000 [0042.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.447] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.448] GetProcessHeap () returned 0x560000 [0042.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.448] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5890c0 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843d8 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.449] GetProcessHeap () returned 0x560000 [0042.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.449] WriteFile (in: hFile=0x230, lpBuffer=0x589a00*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589a00*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.453] GetProcessHeap () returned 0x560000 [0042.453] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589a00, Size=0x30) returned 0x589a00 [0042.453] GetProcessHeap () returned 0x560000 [0042.453] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.453] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.453] GetProcessHeap () returned 0x560000 [0042.453] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12581) returned 0x59eb30 [0042.453] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x12581, lpOverlapped=0x0) returned 1 [0042.455] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.455] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x12581, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x12581, lpOverlapped=0x0) returned 1 [0042.456] GetProcessHeap () returned 0x560000 [0042.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.458] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.458] WriteFile (in: hFile=0x230, lpBuffer=0x589a00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589a00*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.460] CloseHandle (hObject=0x230) returned 1 [0042.462] GetProcessHeap () returned 0x560000 [0042.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0042.462] GetProcessHeap () returned 0x560000 [0042.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.462] GetProcessHeap () returned 0x560000 [0042.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.462] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0042.462] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.badday" [0042.462] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.badday"), dwFlags=0x1) returned 1 [0042.463] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.463] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.463] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.463] GetProcessHeap () returned 0x560000 [0042.463] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.463] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0042.463] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2=".") returned 1 [0042.463] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="..") returned 1 [0042.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0042.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_uk-ua.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.463] GetProcessHeap () returned 0x560000 [0042.463] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_uk-ua.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_uk-ua.htm", lpUsedDefaultChar=0x0) returned 15 [0042.464] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0042.464] lstrlenA (lpString=".badday") returned 7 [0042.464] lstrlenA (lpString=".badday") returned 7 [0042.464] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0042.464] lstrcmpiA (lpString1="-ua.htm", lpString2=".badday") returned 1 [0042.464] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="how_to_back_files.html") returned -1 [0042.464] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.464] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.464] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.464] GetProcessHeap () returned 0x560000 [0042.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0042.464] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.465] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=266731) returned 1 [0042.465] GetProcessHeap () returned 0x560000 [0042.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.465] GetProcessHeap () returned 0x560000 [0042.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.465] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned 52 [0042.465] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.465] GetProcessHeap () returned 0x560000 [0042.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.465] GetProcessHeap () returned 0x560000 [0042.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x385) returned 0x589a38 [0042.465] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.465] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.466] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.466] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.466] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.466] GetProcessHeap () returned 0x560000 [0042.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.466] lstrlenA (lpString="010001") returned 6 [0042.466] GetProcessHeap () returned 0x560000 [0042.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a078 [0042.466] GetProcessHeap () returned 0x560000 [0042.466] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.466] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586720 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584c98 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a178 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5850f8 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589360 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0042.467] GetProcessHeap () returned 0x560000 [0042.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589330 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587380 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589330 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.468] GetProcessHeap () returned 0x560000 [0042.468] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.469] GetProcessHeap () returned 0x560000 [0042.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.470] GetProcessHeap () returned 0x560000 [0042.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.470] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.471] GetProcessHeap () returned 0x560000 [0042.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.471] GetProcessHeap () returned 0x560000 [0042.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.472] GetProcessHeap () returned 0x560000 [0042.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589360 | out: hHeap=0x560000) returned 1 [0042.473] GetProcessHeap () returned 0x560000 [0042.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0042.473] GetProcessHeap () returned 0x560000 [0042.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c98 | out: hHeap=0x560000) returned 1 [0042.473] GetProcessHeap () returned 0x560000 [0042.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586720 | out: hHeap=0x560000) returned 1 [0042.473] GetProcessHeap () returned 0x560000 [0042.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.473] GetProcessHeap () returned 0x560000 [0042.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.473] GetProcessHeap () returned 0x560000 [0042.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.473] WriteFile (in: hFile=0x230, lpBuffer=0x589a38*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589a38*, lpNumberOfBytesWritten=0x24ad864*=0x385, lpOverlapped=0x0) returned 1 [0042.478] GetProcessHeap () returned 0x560000 [0042.478] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589a38, Size=0x30) returned 0x589a38 [0042.478] GetProcessHeap () returned 0x560000 [0042.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.478] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.478] GetProcessHeap () returned 0x560000 [0042.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x411f0) returned 0x59eb30 [0042.483] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x411f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x411f0, lpOverlapped=0x0) returned 1 [0042.488] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.488] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x411f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x411f0, lpOverlapped=0x0) returned 1 [0042.491] GetProcessHeap () returned 0x560000 [0042.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.491] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.491] WriteFile (in: hFile=0x230, lpBuffer=0x589a38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589a38*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.492] CloseHandle (hObject=0x230) returned 1 [0042.498] GetProcessHeap () returned 0x560000 [0042.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0042.498] GetProcessHeap () returned 0x560000 [0042.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.498] GetProcessHeap () returned 0x560000 [0042.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.498] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0042.499] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.badday" [0042.499] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.badday"), dwFlags=0x1) returned 1 [0042.499] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.499] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.499] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.499] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.499] GetProcessHeap () returned 0x560000 [0042.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.499] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0042.499] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2=".") returned 1 [0042.500] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="..") returned 1 [0042.500] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0042.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-cn.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.500] GetProcessHeap () returned 0x560000 [0042.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-cn.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-cn.htm", lpUsedDefaultChar=0x0) returned 15 [0042.500] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0042.500] lstrlenA (lpString=".badday") returned 7 [0042.500] lstrlenA (lpString=".badday") returned 7 [0042.500] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0042.500] lstrcmpiA (lpString1="-cn.htm", lpString2=".badday") returned 1 [0042.500] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="how_to_back_files.html") returned -1 [0042.500] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.500] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.500] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.500] GetProcessHeap () returned 0x560000 [0042.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0042.500] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.500] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=126241) returned 1 [0042.500] GetProcessHeap () returned 0x560000 [0042.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.501] GetProcessHeap () returned 0x560000 [0042.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.501] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned 52 [0042.501] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.501] GetProcessHeap () returned 0x560000 [0042.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.501] GetProcessHeap () returned 0x560000 [0042.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589a70 [0042.501] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.501] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.501] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.501] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.502] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.502] lstrlenA (lpString="010001") returned 6 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5842c0 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584608 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584b80 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589120 [0042.502] GetProcessHeap () returned 0x560000 [0042.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589138 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586cc0 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589138 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.503] GetProcessHeap () returned 0x560000 [0042.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.504] GetProcessHeap () returned 0x560000 [0042.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.505] GetProcessHeap () returned 0x560000 [0042.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.506] GetProcessHeap () returned 0x560000 [0042.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.507] GetProcessHeap () returned 0x560000 [0042.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.507] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584608 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589120 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.508] GetProcessHeap () returned 0x560000 [0042.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.508] WriteFile (in: hFile=0x230, lpBuffer=0x589a70*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589a70*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.513] GetProcessHeap () returned 0x560000 [0042.513] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589a70, Size=0x30) returned 0x589a70 [0042.513] GetProcessHeap () returned 0x560000 [0042.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.513] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.513] GetProcessHeap () returned 0x560000 [0042.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1ed21) returned 0x59eb30 [0042.513] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x1ed21, lpOverlapped=0x0) returned 1 [0042.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.523] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x1ed21, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x1ed21, lpOverlapped=0x0) returned 1 [0042.528] GetProcessHeap () returned 0x560000 [0042.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.528] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.528] WriteFile (in: hFile=0x230, lpBuffer=0x589a70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589a70*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.529] CloseHandle (hObject=0x230) returned 1 [0042.532] GetProcessHeap () returned 0x560000 [0042.532] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0042.533] GetProcessHeap () returned 0x560000 [0042.533] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.533] GetProcessHeap () returned 0x560000 [0042.533] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.533] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0042.533] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.badday" [0042.533] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.badday"), dwFlags=0x1) returned 1 [0042.533] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.533] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.533] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.533] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.534] GetProcessHeap () returned 0x560000 [0042.534] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.534] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0042.534] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2=".") returned 1 [0042.534] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="..") returned 1 [0042.534] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0042.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-hk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.534] GetProcessHeap () returned 0x560000 [0042.534] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-hk.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-hk.htm", lpUsedDefaultChar=0x0) returned 15 [0042.534] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0042.534] lstrlenA (lpString=".badday") returned 7 [0042.534] lstrlenA (lpString=".badday") returned 7 [0042.534] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0042.534] lstrcmpiA (lpString1="-hk.htm", lpString2=".badday") returned 1 [0042.534] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="how_to_back_files.html") returned -1 [0042.534] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.534] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.534] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.534] GetProcessHeap () returned 0x560000 [0042.534] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0042.534] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.535] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=147140) returned 1 [0042.535] GetProcessHeap () returned 0x560000 [0042.535] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.535] GetProcessHeap () returned 0x560000 [0042.535] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.535] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned 52 [0042.535] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.535] GetProcessHeap () returned 0x560000 [0042.535] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.535] GetProcessHeap () returned 0x560000 [0042.535] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589aa8 [0042.535] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.535] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.536] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.536] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.536] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.536] lstrlenA (lpString="010001") returned 6 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cf30 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d050 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5850f8 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.536] GetProcessHeap () returned 0x560000 [0042.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584838 [0042.536] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5891e0 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d950 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b80 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d950 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5890c0 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58d3b0 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5890c0 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d3b0 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.537] GetProcessHeap () returned 0x560000 [0042.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.538] GetProcessHeap () returned 0x560000 [0042.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.538] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.539] GetProcessHeap () returned 0x560000 [0042.539] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.540] GetProcessHeap () returned 0x560000 [0042.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.540] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.541] GetProcessHeap () returned 0x560000 [0042.541] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b80 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5891e0 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d050 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cf30 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.542] GetProcessHeap () returned 0x560000 [0042.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.542] WriteFile (in: hFile=0x230, lpBuffer=0x589aa8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589aa8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.547] GetProcessHeap () returned 0x560000 [0042.547] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589aa8, Size=0x30) returned 0x589aa8 [0042.548] GetProcessHeap () returned 0x560000 [0042.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.548] GetProcessHeap () returned 0x560000 [0042.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x23ec4) returned 0x59eb30 [0042.548] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x23ec4, lpOverlapped=0x0) returned 1 [0042.551] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.551] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x23ec4, lpOverlapped=0x0) returned 1 [0042.553] GetProcessHeap () returned 0x560000 [0042.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.554] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.554] WriteFile (in: hFile=0x230, lpBuffer=0x589aa8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589aa8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.555] CloseHandle (hObject=0x230) returned 1 [0042.559] GetProcessHeap () returned 0x560000 [0042.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0042.559] GetProcessHeap () returned 0x560000 [0042.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.559] GetProcessHeap () returned 0x560000 [0042.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.559] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0042.559] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.badday" [0042.559] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.badday"), dwFlags=0x1) returned 1 [0042.560] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.560] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.560] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.560] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.560] GetProcessHeap () returned 0x560000 [0042.560] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.560] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0042.560] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2=".") returned 1 [0042.560] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="..") returned 1 [0042.560] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0042.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-tw.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.561] GetProcessHeap () returned 0x560000 [0042.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-tw.htm", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-tw.htm", lpUsedDefaultChar=0x0) returned 15 [0042.561] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0042.561] lstrlenA (lpString=".badday") returned 7 [0042.561] lstrlenA (lpString=".badday") returned 7 [0042.561] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0042.561] lstrcmpiA (lpString1="-tw.htm", lpString2=".badday") returned 1 [0042.561] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="how_to_back_files.html") returned -1 [0042.561] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.561] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.561] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.561] GetProcessHeap () returned 0x560000 [0042.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0042.561] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.561] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=147140) returned 1 [0042.562] GetProcessHeap () returned 0x560000 [0042.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.562] GetProcessHeap () returned 0x560000 [0042.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.562] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned 52 [0042.562] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.562] GetProcessHeap () returned 0x560000 [0042.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.562] GetProcessHeap () returned 0x560000 [0042.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x589ae0 [0042.562] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.562] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x570aa8) returned 1 [0042.562] CryptGenRandom (in: hProv=0x570aa8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.563] CryptReleaseContext (hProv=0x570aa8, dwFlags=0x0) returned 1 [0042.563] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.563] lstrlenA (lpString="010001") returned 6 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc60 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d950 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584ec8 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x571ec8 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584db0 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.563] GetProcessHeap () returned 0x560000 [0042.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589390 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d320 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584838 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d320 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5892e8 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58d0e0 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5892e8 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d0e0 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.564] GetProcessHeap () returned 0x560000 [0042.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.564] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.565] GetProcessHeap () returned 0x560000 [0042.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.566] GetProcessHeap () returned 0x560000 [0042.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.566] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.567] GetProcessHeap () returned 0x560000 [0042.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.568] GetProcessHeap () returned 0x560000 [0042.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.568] GetProcessHeap () returned 0x560000 [0042.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584db0 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589390 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d950 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc60 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.569] GetProcessHeap () returned 0x560000 [0042.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.569] WriteFile (in: hFile=0x230, lpBuffer=0x589ae0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589ae0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.573] GetProcessHeap () returned 0x560000 [0042.573] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589ae0, Size=0x30) returned 0x589ae0 [0042.573] GetProcessHeap () returned 0x560000 [0042.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.573] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.573] GetProcessHeap () returned 0x560000 [0042.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x23ec4) returned 0x59eb30 [0042.576] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x23ec4, lpOverlapped=0x0) returned 1 [0042.583] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.583] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x23ec4, lpOverlapped=0x0) returned 1 [0042.585] GetProcessHeap () returned 0x560000 [0042.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.585] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.585] WriteFile (in: hFile=0x230, lpBuffer=0x589ae0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589ae0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.586] CloseHandle (hObject=0x230) returned 1 [0042.590] GetProcessHeap () returned 0x560000 [0042.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0042.590] GetProcessHeap () returned 0x560000 [0042.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.590] GetProcessHeap () returned 0x560000 [0042.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.590] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0042.590] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.badday") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.badday" [0042.590] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.badday" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.badday"), dwFlags=0x1) returned 1 [0042.590] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0042.590] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0042.590] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.590] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_to_back_files.html")) returned 0x20 [0042.590] GetProcessHeap () returned 0x560000 [0042.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.591] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6833b567, ftCreationTime.dwHighDateTime=0x1d5782b, ftLastAccessTime.dwLowDateTime=0x6833b567, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x68387c9b, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x15c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="how_to_back_files.html", cAlternateFileName="HOW_TO~1.HTM")) returned 1 [0042.591] lstrcmpiW (lpString1="how_to_back_files.html", lpString2=".") returned 1 [0042.591] lstrcmpiW (lpString1="how_to_back_files.html", lpString2="..") returned 1 [0042.591] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\how_to_back_files.html" [0042.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="how_to_back_files.html", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0042.591] GetProcessHeap () returned 0x560000 [0042.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x5767f8 [0042.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="how_to_back_files.html", cchWideChar=-1, lpMultiByteStr=0x5767f8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="how_to_back_files.html", lpUsedDefaultChar=0x0) returned 23 [0042.591] lstrlenA (lpString="how_to_back_files.html") returned 22 [0042.591] lstrlenA (lpString=".badday") returned 7 [0042.591] lstrlenA (lpString=".badday") returned 7 [0042.591] lstrlenA (lpString="how_to_back_files.html") returned 22 [0042.591] lstrcmpiA (lpString1="es.html", lpString2=".badday") returned 1 [0042.591] lstrcmpiW (lpString1="how_to_back_files.html", lpString2="how_to_back_files.html") returned 0 [0042.591] GetProcessHeap () returned 0x560000 [0042.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5767f8 | out: hHeap=0x560000) returned 1 [0042.591] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6833b567, ftCreationTime.dwHighDateTime=0x1d5782b, ftLastAccessTime.dwLowDateTime=0x6833b567, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x68387c9b, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x15c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="how_to_back_files.html", cAlternateFileName="HOW_TO~1.HTM")) returned 0 [0042.591] FindClose (in: hFindFile=0x579488 | out: hFindFile=0x579488) returned 1 [0042.591] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0042.592] GetProcessHeap () returned 0x560000 [0042.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585910 | out: hHeap=0x560000) returned 1 [0042.592] GetProcessHeap () returned 0x560000 [0042.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.592] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\") returned 35 [0042.592] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\*") returned="C:\\Windows10Upgrade\\resources\\i386\\*" [0042.592] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579488 [0042.594] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.594] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.594] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.594] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.594] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0042.594] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2=".") returned 1 [0042.594] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="..") returned 1 [0042.594] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0042.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.594] GetProcessHeap () returned 0x560000 [0042.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0042.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BiosBlocks.xml", lpUsedDefaultChar=0x0) returned 15 [0042.594] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0042.594] lstrlenA (lpString=".badday") returned 7 [0042.594] lstrlenA (lpString=".badday") returned 7 [0042.594] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0042.594] lstrcmpiA (lpString1="cks.xml", lpString2=".badday") returned 1 [0042.594] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="how_to_back_files.html") returned -1 [0042.594] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.594] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.594] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.595] GetProcessHeap () returned 0x560000 [0042.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0042.595] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.595] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=91648) returned 1 [0042.595] GetProcessHeap () returned 0x560000 [0042.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.596] GetProcessHeap () returned 0x560000 [0042.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.596] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned 49 [0042.596] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.596] GetProcessHeap () returned 0x560000 [0042.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.596] GetProcessHeap () returned 0x560000 [0042.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x588fa0 [0042.596] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.596] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x589f20) returned 1 [0042.596] CryptGenRandom (in: hProv=0x589f20, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.596] CryptReleaseContext (hProv=0x589f20, dwFlags=0x0) returned 1 [0042.597] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0042.597] lstrlenA (lpString="010001") returned 6 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cea0 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d7a0 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584838 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589fd8 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584950 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584720 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5844f0 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c68 [0042.597] GetProcessHeap () returned 0x560000 [0042.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d5f0 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5842c0 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d5f0 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cf30 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584fe0 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cf30 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.598] GetProcessHeap () returned 0x560000 [0042.598] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.599] GetProcessHeap () returned 0x560000 [0042.599] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.600] GetProcessHeap () returned 0x560000 [0042.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.601] GetProcessHeap () returned 0x560000 [0042.601] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.602] GetProcessHeap () returned 0x560000 [0042.602] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5842c0 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c68 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d7a0 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584838 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cea0 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584950 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.603] GetProcessHeap () returned 0x560000 [0042.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0042.603] WriteFile (in: hFile=0x230, lpBuffer=0x588fa0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x588fa0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0042.606] GetProcessHeap () returned 0x560000 [0042.606] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x588fa0, Size=0x30) returned 0x588fa0 [0042.606] GetProcessHeap () returned 0x560000 [0042.606] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.606] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.606] GetProcessHeap () returned 0x560000 [0042.606] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16600) returned 0x59eb30 [0042.606] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x16600, lpOverlapped=0x0) returned 1 [0042.609] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.609] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x16600, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x16600, lpOverlapped=0x0) returned 1 [0042.611] GetProcessHeap () returned 0x560000 [0042.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.612] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.612] WriteFile (in: hFile=0x230, lpBuffer=0x588fa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x588fa0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.613] CloseHandle (hObject=0x230) returned 1 [0042.616] GetProcessHeap () returned 0x560000 [0042.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0042.616] GetProcessHeap () returned 0x560000 [0042.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.616] GetProcessHeap () returned 0x560000 [0042.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.616] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0042.616] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.badday") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.badday" [0042.616] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.badday" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.badday"), dwFlags=0x1) returned 1 [0042.620] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0042.620] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0042.620] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" [0042.620] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html")) returned 0xffffffff [0042.620] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0042.620] GetProcessHeap () returned 0x560000 [0042.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.620] GetProcessHeap () returned 0x560000 [0042.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0042.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.628] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.640] GetProcessHeap () returned 0x560000 [0042.640] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.640] GetProcessHeap () returned 0x560000 [0042.640] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0042.640] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0042.640] GetProcessHeap () returned 0x560000 [0042.640] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.640] GetProcessHeap () returned 0x560000 [0042.640] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0042.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0042.667] GetProcessHeap () returned 0x560000 [0042.667] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.667] GetProcessHeap () returned 0x560000 [0042.667] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0042.667] CloseHandle (hObject=0x230) returned 1 [0042.667] GetProcessHeap () returned 0x560000 [0042.667] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.667] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0042.667] lstrcmpiW (lpString1="hwcompat.txt", lpString2=".") returned 1 [0042.667] lstrcmpiW (lpString1="hwcompat.txt", lpString2="..") returned 1 [0042.667] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0042.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.667] GetProcessHeap () returned 0x560000 [0042.667] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0042.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompat.txt", lpUsedDefaultChar=0x0) returned 13 [0042.668] lstrlenA (lpString="hwcompat.txt") returned 12 [0042.668] lstrlenA (lpString=".badday") returned 7 [0042.668] lstrlenA (lpString=".badday") returned 7 [0042.668] lstrlenA (lpString="hwcompat.txt") returned 12 [0042.668] lstrcmpiA (lpString1="pat.txt", lpString2=".badday") returned 1 [0042.668] lstrcmpiW (lpString1="hwcompat.txt", lpString2="how_to_back_files.html") returned 1 [0042.668] lstrcmpiW (lpString1="hwcompat.txt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.668] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.668] lstrcmpiW (lpString1="hwcompat.txt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.668] GetProcessHeap () returned 0x560000 [0042.668] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d288 [0042.668] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.668] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=16497) returned 1 [0042.668] GetProcessHeap () returned 0x560000 [0042.668] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.668] GetProcessHeap () returned 0x560000 [0042.668] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0042.668] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned 47 [0042.668] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.668] GetProcessHeap () returned 0x560000 [0042.668] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.669] GetProcessHeap () returned 0x560000 [0042.669] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x588fd8 [0042.669] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.669] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0042.669] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.669] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0042.669] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.669] GetProcessHeap () returned 0x560000 [0042.669] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.669] lstrlenA (lpString="010001") returned 6 [0042.669] GetProcessHeap () returned 0x560000 [0042.669] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0042.669] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d950 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc60 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584720 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584ec8 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5844f0 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.670] GetProcessHeap () returned 0x560000 [0042.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584fe0 [0042.670] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c68 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d050 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584a68 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d050 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d58 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58d830 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d58 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5850f8 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d830 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.671] GetProcessHeap () returned 0x560000 [0042.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.671] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.672] GetProcessHeap () returned 0x560000 [0042.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.673] GetProcessHeap () returned 0x560000 [0042.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.674] GetProcessHeap () returned 0x560000 [0042.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5844f0 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a68 | out: hHeap=0x560000) returned 1 [0042.675] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fe0 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850f8 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c68 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc60 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d950 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ec8 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.676] GetProcessHeap () returned 0x560000 [0042.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.676] WriteFile (in: hFile=0x230, lpBuffer=0x588fd8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x588fd8*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0042.822] GetProcessHeap () returned 0x560000 [0042.822] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x588fd8, Size=0x30) returned 0x588fd8 [0042.822] GetProcessHeap () returned 0x560000 [0042.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.822] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.822] GetProcessHeap () returned 0x560000 [0042.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4080) returned 0x59eb30 [0042.823] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x4080, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x4080, lpOverlapped=0x0) returned 1 [0042.824] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.824] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x4080, lpOverlapped=0x0) returned 1 [0042.826] GetProcessHeap () returned 0x560000 [0042.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.826] WriteFile (in: hFile=0x230, lpBuffer=0x588fd8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x588fd8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.827] CloseHandle (hObject=0x230) returned 1 [0042.829] GetProcessHeap () returned 0x560000 [0042.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d288 | out: hHeap=0x560000) returned 1 [0042.829] GetProcessHeap () returned 0x560000 [0042.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.829] GetProcessHeap () returned 0x560000 [0042.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0042.829] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0042.829] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.badday") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.badday" [0042.829] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.badday" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.badday"), dwFlags=0x1) returned 1 [0042.829] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0042.829] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0042.829] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" [0042.829] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html")) returned 0x20 [0042.830] GetProcessHeap () returned 0x560000 [0042.830] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.830] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0042.830] lstrcmpiW (lpString1="hwexclude.txt", lpString2=".") returned 1 [0042.830] lstrcmpiW (lpString1="hwexclude.txt", lpString2="..") returned 1 [0042.830] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0042.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.830] GetProcessHeap () returned 0x560000 [0042.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0042.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwexclude.txt", lpUsedDefaultChar=0x0) returned 14 [0042.830] lstrlenA (lpString="hwexclude.txt") returned 13 [0042.830] lstrlenA (lpString=".badday") returned 7 [0042.830] lstrlenA (lpString=".badday") returned 7 [0042.830] lstrlenA (lpString="hwexclude.txt") returned 13 [0042.830] lstrcmpiA (lpString1="ude.txt", lpString2=".badday") returned 1 [0042.830] lstrcmpiW (lpString1="hwexclude.txt", lpString2="how_to_back_files.html") returned 1 [0042.830] lstrcmpiW (lpString1="hwexclude.txt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.830] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.830] lstrcmpiW (lpString1="hwexclude.txt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0042.830] GetProcessHeap () returned 0x560000 [0042.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0042.830] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.831] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2263) returned 1 [0042.831] GetProcessHeap () returned 0x560000 [0042.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.831] GetProcessHeap () returned 0x560000 [0042.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0042.831] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned 48 [0042.831] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.831] GetProcessHeap () returned 0x560000 [0042.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.831] GetProcessHeap () returned 0x560000 [0042.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x589010 [0042.831] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.831] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0042.831] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.832] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0042.832] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.832] lstrlenA (lpString="010001") returned 6 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d050 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58da70 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58bc50 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bb38 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c858 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bd68 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.832] GetProcessHeap () returned 0x560000 [0042.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bc0 [0042.832] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d7a0 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c510 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d7a0 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cc8 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cb40 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cc8 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58be80 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb40 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.833] GetProcessHeap () returned 0x560000 [0042.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.833] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.834] GetProcessHeap () returned 0x560000 [0042.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.835] GetProcessHeap () returned 0x560000 [0042.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.835] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.836] GetProcessHeap () returned 0x560000 [0042.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0042.837] GetProcessHeap () returned 0x560000 [0042.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c510 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be80 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bc0 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58da70 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d050 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.838] GetProcessHeap () returned 0x560000 [0042.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.838] WriteFile (in: hFile=0x230, lpBuffer=0x589010*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589010*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0042.841] GetProcessHeap () returned 0x560000 [0042.841] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x589010, Size=0x30) returned 0x589010 [0042.841] GetProcessHeap () returned 0x560000 [0042.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0042.841] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.841] GetProcessHeap () returned 0x560000 [0042.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8e0) returned 0x59eb30 [0042.842] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x8e0, lpOverlapped=0x0) returned 1 [0042.842] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0042.842] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x8e0, lpOverlapped=0x0) returned 1 [0042.843] GetProcessHeap () returned 0x560000 [0042.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0042.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.843] WriteFile (in: hFile=0x230, lpBuffer=0x589010*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x589010*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0042.844] CloseHandle (hObject=0x230) returned 1 [0042.845] GetProcessHeap () returned 0x560000 [0042.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0042.845] GetProcessHeap () returned 0x560000 [0042.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0042.845] GetProcessHeap () returned 0x560000 [0042.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0042.845] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0042.845] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.badday") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.badday" [0042.845] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.badday" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.badday"), dwFlags=0x1) returned 1 [0042.845] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0042.845] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0042.845] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" [0042.846] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html")) returned 0x20 [0042.846] GetProcessHeap () returned 0x560000 [0042.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0042.846] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0042.846] lstrcmpiW (lpString1="nxquery.cat", lpString2=".") returned 1 [0042.846] lstrcmpiW (lpString1="nxquery.cat", lpString2="..") returned 1 [0042.846] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0042.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.846] GetProcessHeap () returned 0x560000 [0042.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0042.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.cat", lpUsedDefaultChar=0x0) returned 12 [0042.846] lstrlenA (lpString="nxquery.cat") returned 11 [0042.846] lstrlenA (lpString=".badday") returned 7 [0042.846] lstrlenA (lpString=".badday") returned 7 [0042.846] lstrlenA (lpString="nxquery.cat") returned 11 [0042.846] lstrcmpiA (lpString1="ery.cat", lpString2=".badday") returned 1 [0042.846] lstrcmpiW (lpString1="nxquery.cat", lpString2="how_to_back_files.html") returned 1 [0042.846] lstrcmpiW (lpString1="nxquery.cat", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0042.846] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0042.846] lstrcmpiW (lpString1="nxquery.cat", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0042.846] GetProcessHeap () returned 0x560000 [0042.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0042.846] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0042.847] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=9860) returned 1 [0042.847] GetProcessHeap () returned 0x560000 [0042.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0042.847] GetProcessHeap () returned 0x560000 [0042.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0042.847] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned 46 [0042.847] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0042.847] GetProcessHeap () returned 0x560000 [0042.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0042.847] GetProcessHeap () returned 0x560000 [0042.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e0f8 [0042.847] lstrlenA (lpString="rsa_encrypt") returned 11 [0042.847] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0042.848] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0042.848] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0042.848] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0042.848] lstrlenA (lpString="010001") returned 6 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d0e0 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb40 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58c3f8 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bf98 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c970 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0042.848] GetProcessHeap () returned 0x560000 [0042.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bb38 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ed8 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58d290 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c858 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d290 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e60 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58d830 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e60 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58be80 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d830 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.849] GetProcessHeap () returned 0x560000 [0042.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.850] GetProcessHeap () returned 0x560000 [0042.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.851] GetProcessHeap () returned 0x560000 [0042.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.851] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.852] GetProcessHeap () returned 0x560000 [0042.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0042.853] GetProcessHeap () returned 0x560000 [0042.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0042.853] GetProcessHeap () returned 0x560000 [0042.854] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c970 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be80 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ed8 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb40 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3f8 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d0e0 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf98 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0042.854] GetProcessHeap () returned 0x560000 [0042.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0042.854] WriteFile (in: hFile=0x230, lpBuffer=0x56e0f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e0f8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0043.002] GetProcessHeap () returned 0x560000 [0043.002] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e0f8, Size=0x30) returned 0x56e0f8 [0043.002] GetProcessHeap () returned 0x560000 [0043.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.002] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.002] GetProcessHeap () returned 0x560000 [0043.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2684) returned 0x59eb30 [0043.002] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x2684, lpOverlapped=0x0) returned 1 [0043.003] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.003] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x2684, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x2684, lpOverlapped=0x0) returned 1 [0043.004] GetProcessHeap () returned 0x560000 [0043.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0043.005] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.005] WriteFile (in: hFile=0x230, lpBuffer=0x56e0f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e0f8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0043.006] CloseHandle (hObject=0x230) returned 1 [0043.007] GetProcessHeap () returned 0x560000 [0043.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0043.007] GetProcessHeap () returned 0x560000 [0043.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.008] GetProcessHeap () returned 0x560000 [0043.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.008] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0043.008] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.badday") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.badday" [0043.008] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.badday" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.badday"), dwFlags=0x1) returned 1 [0043.008] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0043.008] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0043.008] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" [0043.008] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html")) returned 0x20 [0043.009] GetProcessHeap () returned 0x560000 [0043.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0043.009] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0043.009] lstrcmpiW (lpString1="nxquery.inf", lpString2=".") returned 1 [0043.009] lstrcmpiW (lpString1="nxquery.inf", lpString2="..") returned 1 [0043.009] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0043.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.009] GetProcessHeap () returned 0x560000 [0043.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0043.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.inf", lpUsedDefaultChar=0x0) returned 12 [0043.009] lstrlenA (lpString="nxquery.inf") returned 11 [0043.009] lstrlenA (lpString=".badday") returned 7 [0043.009] lstrlenA (lpString=".badday") returned 7 [0043.009] lstrlenA (lpString="nxquery.inf") returned 11 [0043.009] lstrcmpiA (lpString1="ery.inf", lpString2=".badday") returned 1 [0043.009] lstrcmpiW (lpString1="nxquery.inf", lpString2="how_to_back_files.html") returned 1 [0043.009] lstrcmpiW (lpString1="nxquery.inf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0043.009] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0043.009] lstrcmpiW (lpString1="nxquery.inf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0043.009] GetProcessHeap () returned 0x560000 [0043.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0043.009] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0043.010] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1495) returned 1 [0043.010] GetProcessHeap () returned 0x560000 [0043.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.010] GetProcessHeap () returned 0x560000 [0043.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.010] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned 46 [0043.010] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.010] GetProcessHeap () returned 0x560000 [0043.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0043.010] GetProcessHeap () returned 0x560000 [0043.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x56e130 [0043.010] lstrlenA (lpString="rsa_encrypt") returned 11 [0043.010] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0043.010] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0043.011] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0043.011] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0043.011] lstrlenA (lpString="010001") returned 6 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58bb38 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a068 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c970 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bf98 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58c0b0 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.011] GetProcessHeap () returned 0x560000 [0043.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ef0 [0043.011] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c1c8 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e60 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5867b0 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e60 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c2e0 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.012] GetProcessHeap () returned 0x560000 [0043.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.013] GetProcessHeap () returned 0x560000 [0043.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.014] GetProcessHeap () returned 0x560000 [0043.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.015] GetProcessHeap () returned 0x560000 [0043.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.016] GetProcessHeap () returned 0x560000 [0043.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf98 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1c8 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0b0 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2e0 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ef0 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c970 | out: hHeap=0x560000) returned 1 [0043.017] GetProcessHeap () returned 0x560000 [0043.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.018] GetProcessHeap () returned 0x560000 [0043.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0043.018] WriteFile (in: hFile=0x230, lpBuffer=0x56e130*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e130*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0043.020] GetProcessHeap () returned 0x560000 [0043.020] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e130, Size=0x30) returned 0x56e130 [0043.021] GetProcessHeap () returned 0x560000 [0043.021] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.021] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.021] GetProcessHeap () returned 0x560000 [0043.021] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5e0) returned 0x56e168 [0043.021] ReadFile (in: hFile=0x230, lpBuffer=0x56e168, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x56e168*, lpNumberOfBytesRead=0x24ad7e8*=0x5e0, lpOverlapped=0x0) returned 1 [0043.021] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.021] WriteFile (in: hFile=0x230, lpBuffer=0x56e168*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x56e168*, lpNumberOfBytesWritten=0x24ad7e4*=0x5e0, lpOverlapped=0x0) returned 1 [0043.024] GetProcessHeap () returned 0x560000 [0043.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e168 | out: hHeap=0x560000) returned 1 [0043.024] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.024] WriteFile (in: hFile=0x230, lpBuffer=0x56e130*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e130*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0043.025] CloseHandle (hObject=0x230) returned 1 [0043.026] GetProcessHeap () returned 0x560000 [0043.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0043.026] GetProcessHeap () returned 0x560000 [0043.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.026] GetProcessHeap () returned 0x560000 [0043.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.026] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0043.026] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.badday") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.badday" [0043.026] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.badday" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.badday"), dwFlags=0x1) returned 1 [0043.027] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0043.027] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0043.027] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" [0043.027] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html")) returned 0x20 [0043.027] GetProcessHeap () returned 0x560000 [0043.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0043.027] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0043.027] lstrcmpiW (lpString1="NXQuery.sys", lpString2=".") returned 1 [0043.027] lstrcmpiW (lpString1="NXQuery.sys", lpString2="..") returned 1 [0043.027] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" [0043.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.027] GetProcessHeap () returned 0x560000 [0043.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0043.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NXQuery.sys", lpUsedDefaultChar=0x0) returned 12 [0043.027] lstrlenA (lpString="NXQuery.sys") returned 11 [0043.027] lstrlenA (lpString=".badday") returned 7 [0043.027] lstrlenA (lpString=".badday") returned 7 [0043.027] lstrlenA (lpString="NXQuery.sys") returned 11 [0043.027] lstrcmpiA (lpString1="ery.sys", lpString2=".badday") returned 1 [0043.027] lstrcmpiW (lpString1="NXQuery.sys", lpString2="how_to_back_files.html") returned 1 [0043.027] lstrcmpiW (lpString1="NXQuery.sys", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0043.027] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0043.027] lstrcmpiW (lpString1="NXQuery.sys", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0043.027] GetProcessHeap () returned 0x560000 [0043.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0043.028] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0043.028] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=20144) returned 1 [0043.028] GetProcessHeap () returned 0x560000 [0043.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.028] GetProcessHeap () returned 0x560000 [0043.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.028] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned 46 [0043.028] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.028] GetProcessHeap () returned 0x560000 [0043.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0043.028] GetProcessHeap () returned 0x560000 [0043.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e168 [0043.028] lstrlenA (lpString="rsa_encrypt") returned 11 [0043.028] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0043.029] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0043.029] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0043.029] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0043.029] GetProcessHeap () returned 0x560000 [0043.029] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0043.029] lstrlenA (lpString="010001") returned 6 [0043.029] GetProcessHeap () returned 0x560000 [0043.029] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0043.029] GetProcessHeap () returned 0x560000 [0043.029] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.029] GetProcessHeap () returned 0x560000 [0043.029] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0043.029] GetProcessHeap () returned 0x560000 [0043.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58c740 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58be80 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c2e0 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bd68 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ba8 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bb38 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c68 [0043.030] GetProcessHeap () returned 0x560000 [0043.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.030] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586ba0 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c68 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c3f8 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.031] GetProcessHeap () returned 0x560000 [0043.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.031] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.032] GetProcessHeap () returned 0x560000 [0043.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0043.033] GetProcessHeap () returned 0x560000 [0043.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.034] GetProcessHeap () returned 0x560000 [0043.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2e0 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3f8 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ba8 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c740 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be80 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.035] GetProcessHeap () returned 0x560000 [0043.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0043.036] WriteFile (in: hFile=0x230, lpBuffer=0x56e168*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e168*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0043.041] GetProcessHeap () returned 0x560000 [0043.041] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e168, Size=0x30) returned 0x56e168 [0043.041] GetProcessHeap () returned 0x560000 [0043.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.041] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.041] GetProcessHeap () returned 0x560000 [0043.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4eb0) returned 0x59eb30 [0043.042] ReadFile (in: hFile=0x230, lpBuffer=0x59eb30, nNumberOfBytesToRead=0x4eb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesRead=0x24ad7e8*=0x4eb0, lpOverlapped=0x0) returned 1 [0043.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.043] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad7e4*=0x4eb0, lpOverlapped=0x0) returned 1 [0043.045] GetProcessHeap () returned 0x560000 [0043.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59eb30 | out: hHeap=0x560000) returned 1 [0043.046] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.046] WriteFile (in: hFile=0x230, lpBuffer=0x56e168*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e168*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0043.047] CloseHandle (hObject=0x230) returned 1 [0043.049] GetProcessHeap () returned 0x560000 [0043.049] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0043.049] GetProcessHeap () returned 0x560000 [0043.049] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.049] GetProcessHeap () returned 0x560000 [0043.049] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.049] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" [0043.049] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.badday") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.badday" [0043.049] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.badday" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys.badday"), dwFlags=0x1) returned 1 [0043.049] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0043.049] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0043.049] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" [0043.049] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_to_back_files.html")) returned 0x20 [0043.050] GetProcessHeap () returned 0x560000 [0043.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0043.050] FindNextFileW (in: hFindFile=0x579488, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0043.050] FindClose (in: hFindFile=0x579488 | out: hFindFile=0x579488) returned 1 [0043.050] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0043.050] GetProcessHeap () returned 0x560000 [0043.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b800 | out: hHeap=0x560000) returned 1 [0043.050] GetProcessHeap () returned 0x560000 [0043.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.050] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\") returned 36 [0043.050] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\*") returned="C:\\Windows10Upgrade\\resources\\amd64\\*" [0043.050] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579848 [0043.051] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.051] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.052] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.052] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.052] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0043.052] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2=".") returned 1 [0043.052] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="..") returned 1 [0043.052] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0043.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.052] GetProcessHeap () returned 0x560000 [0043.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0043.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BiosBlocks.xml", lpUsedDefaultChar=0x0) returned 15 [0043.052] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0043.052] lstrlenA (lpString=".badday") returned 7 [0043.052] lstrlenA (lpString=".badday") returned 7 [0043.052] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0043.052] lstrcmpiA (lpString1="cks.xml", lpString2=".badday") returned 1 [0043.052] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="how_to_back_files.html") returned -1 [0043.052] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0043.052] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0043.052] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0043.052] GetProcessHeap () returned 0x560000 [0043.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0043.052] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0043.053] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=93884) returned 1 [0043.053] GetProcessHeap () returned 0x560000 [0043.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.053] GetProcessHeap () returned 0x560000 [0043.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.053] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned 50 [0043.053] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.053] GetProcessHeap () returned 0x560000 [0043.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0043.054] GetProcessHeap () returned 0x560000 [0043.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e1a0 [0043.054] lstrlenA (lpString="rsa_encrypt") returned 11 [0043.054] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0043.055] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0043.055] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0043.055] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0043.055] GetProcessHeap () returned 0x560000 [0043.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0043.055] lstrlenA (lpString="010001") returned 6 [0043.055] GetProcessHeap () returned 0x560000 [0043.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0043.055] GetProcessHeap () returned 0x560000 [0043.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.055] GetProcessHeap () returned 0x560000 [0043.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587020 [0043.055] GetProcessHeap () returned 0x560000 [0043.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58bb38 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bc50 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58be80 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bf98 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b60 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c510 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e30 [0043.056] GetProcessHeap () returned 0x560000 [0043.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.056] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5869f0 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e30 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bd68 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.057] GetProcessHeap () returned 0x560000 [0043.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.058] GetProcessHeap () returned 0x560000 [0043.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.058] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.059] GetProcessHeap () returned 0x560000 [0043.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.060] GetProcessHeap () returned 0x560000 [0043.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be80 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c510 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf98 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0043.061] GetProcessHeap () returned 0x560000 [0043.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b60 | out: hHeap=0x560000) returned 1 [0043.062] GetProcessHeap () returned 0x560000 [0043.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0043.062] GetProcessHeap () returned 0x560000 [0043.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0043.062] GetProcessHeap () returned 0x560000 [0043.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587020 | out: hHeap=0x560000) returned 1 [0043.062] GetProcessHeap () returned 0x560000 [0043.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0043.062] GetProcessHeap () returned 0x560000 [0043.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.062] GetProcessHeap () returned 0x560000 [0043.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0043.062] WriteFile (in: hFile=0x230, lpBuffer=0x56e1a0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e1a0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0043.066] GetProcessHeap () returned 0x560000 [0043.066] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e1a0, Size=0x30) returned 0x56e1a0 [0043.066] GetProcessHeap () returned 0x560000 [0043.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.066] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.066] GetProcessHeap () returned 0x560000 [0043.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16ebc) returned 0x59f338 [0043.067] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x16ebc, lpOverlapped=0x0) returned 1 [0043.069] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.070] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x16ebc, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x16ebc, lpOverlapped=0x0) returned 1 [0043.071] GetProcessHeap () returned 0x560000 [0043.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0043.071] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.072] WriteFile (in: hFile=0x230, lpBuffer=0x56e1a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e1a0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0043.072] CloseHandle (hObject=0x230) returned 1 [0043.075] GetProcessHeap () returned 0x560000 [0043.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0043.075] GetProcessHeap () returned 0x560000 [0043.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.075] GetProcessHeap () returned 0x560000 [0043.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.075] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0043.075] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.badday") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.badday" [0043.076] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.badday" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.badday"), dwFlags=0x1) returned 1 [0043.076] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0043.076] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0043.076] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" [0043.077] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html")) returned 0xffffffff [0043.077] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0043.077] GetProcessHeap () returned 0x560000 [0043.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.077] GetProcessHeap () returned 0x560000 [0043.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.096] GetProcessHeap () returned 0x560000 [0043.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.096] GetProcessHeap () returned 0x560000 [0043.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.096] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0043.096] GetProcessHeap () returned 0x560000 [0043.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.096] GetProcessHeap () returned 0x560000 [0043.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.110] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0043.112] GetProcessHeap () returned 0x560000 [0043.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.112] GetProcessHeap () returned 0x560000 [0043.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.112] CloseHandle (hObject=0x230) returned 1 [0043.113] GetProcessHeap () returned 0x560000 [0043.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0043.113] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0043.113] lstrcmpiW (lpString1="hwcompat.txt", lpString2=".") returned 1 [0043.113] lstrcmpiW (lpString1="hwcompat.txt", lpString2="..") returned 1 [0043.113] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0043.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.113] GetProcessHeap () returned 0x560000 [0043.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0043.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompat.txt", lpUsedDefaultChar=0x0) returned 13 [0043.113] lstrlenA (lpString="hwcompat.txt") returned 12 [0043.113] lstrlenA (lpString=".badday") returned 7 [0043.113] lstrlenA (lpString=".badday") returned 7 [0043.113] lstrlenA (lpString="hwcompat.txt") returned 12 [0043.113] lstrcmpiA (lpString1="pat.txt", lpString2=".badday") returned 1 [0043.113] lstrcmpiW (lpString1="hwcompat.txt", lpString2="how_to_back_files.html") returned 1 [0043.113] lstrcmpiW (lpString1="hwcompat.txt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0043.113] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0043.113] lstrcmpiW (lpString1="hwcompat.txt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0043.113] GetProcessHeap () returned 0x560000 [0043.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0043.113] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0043.114] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=73135) returned 1 [0043.114] GetProcessHeap () returned 0x560000 [0043.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.114] GetProcessHeap () returned 0x560000 [0043.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.114] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned 48 [0043.114] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.114] GetProcessHeap () returned 0x560000 [0043.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0043.114] GetProcessHeap () returned 0x560000 [0043.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x56e1d8 [0043.114] lstrlenA (lpString="rsa_encrypt") returned 11 [0043.114] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0043.115] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0043.115] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0043.115] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0043.115] lstrlenA (lpString="010001") returned 6 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58be80 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c858 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bc50 [0043.115] GetProcessHeap () returned 0x560000 [0043.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.115] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bb38 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e30 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bd68 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e00 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586de0 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e00 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c628 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.116] GetProcessHeap () returned 0x560000 [0043.116] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.116] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0043.117] GetProcessHeap () returned 0x560000 [0043.117] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0043.117] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.118] GetProcessHeap () returned 0x560000 [0043.118] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.119] GetProcessHeap () returned 0x560000 [0043.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.120] GetProcessHeap () returned 0x560000 [0043.120] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.120] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c628 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e30 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be80 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.121] GetProcessHeap () returned 0x560000 [0043.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0043.121] WriteFile (in: hFile=0x230, lpBuffer=0x56e1d8*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e1d8*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0043.126] GetProcessHeap () returned 0x560000 [0043.126] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e1d8, Size=0x30) returned 0x56e1d8 [0043.126] GetProcessHeap () returned 0x560000 [0043.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.126] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.126] GetProcessHeap () returned 0x560000 [0043.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11db0) returned 0x59f338 [0043.126] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x11db0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x11db0, lpOverlapped=0x0) returned 1 [0043.128] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.128] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x11db0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x11db0, lpOverlapped=0x0) returned 1 [0043.131] GetProcessHeap () returned 0x560000 [0043.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0043.132] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.132] WriteFile (in: hFile=0x230, lpBuffer=0x56e1d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e1d8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0043.133] CloseHandle (hObject=0x230) returned 1 [0043.136] GetProcessHeap () returned 0x560000 [0043.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0043.136] GetProcessHeap () returned 0x560000 [0043.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.136] GetProcessHeap () returned 0x560000 [0043.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.136] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0043.136] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.badday") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.badday" [0043.136] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.badday" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.badday"), dwFlags=0x1) returned 1 [0043.136] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0043.136] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0043.136] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" [0043.137] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html")) returned 0x20 [0043.137] GetProcessHeap () returned 0x560000 [0043.137] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0043.137] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0043.137] lstrcmpiW (lpString1="hwexclude.txt", lpString2=".") returned 1 [0043.137] lstrcmpiW (lpString1="hwexclude.txt", lpString2="..") returned 1 [0043.137] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0043.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0043.137] GetProcessHeap () returned 0x560000 [0043.137] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0043.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwexclude.txt", lpUsedDefaultChar=0x0) returned 14 [0043.137] lstrlenA (lpString="hwexclude.txt") returned 13 [0043.137] lstrlenA (lpString=".badday") returned 7 [0043.137] lstrlenA (lpString=".badday") returned 7 [0043.137] lstrlenA (lpString="hwexclude.txt") returned 13 [0043.137] lstrcmpiA (lpString1="ude.txt", lpString2=".badday") returned 1 [0043.137] lstrcmpiW (lpString1="hwexclude.txt", lpString2="how_to_back_files.html") returned 1 [0043.137] lstrcmpiW (lpString1="hwexclude.txt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0043.137] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0043.137] lstrcmpiW (lpString1="hwexclude.txt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0043.137] GetProcessHeap () returned 0x560000 [0043.137] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0043.137] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0043.138] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2317) returned 1 [0043.138] GetProcessHeap () returned 0x560000 [0043.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.138] GetProcessHeap () returned 0x560000 [0043.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.138] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned 49 [0043.138] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.138] GetProcessHeap () returned 0x560000 [0043.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0043.138] GetProcessHeap () returned 0x560000 [0043.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x56e210 [0043.138] lstrlenA (lpString="rsa_encrypt") returned 11 [0043.138] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0043.139] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0043.139] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0043.139] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0043.139] lstrlenA (lpString="010001") returned 6 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58c2e0 [0043.139] GetProcessHeap () returned 0x560000 [0043.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1a8 [0043.139] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bc50 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bd68 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58c970 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cc8 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c628 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b48 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586d50 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b48 | out: hHeap=0x560000) returned 1 [0043.140] GetProcessHeap () returned 0x560000 [0043.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c510 [0043.140] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.141] GetProcessHeap () returned 0x560000 [0043.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.142] GetProcessHeap () returned 0x560000 [0043.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.143] GetProcessHeap () returned 0x560000 [0043.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.144] GetProcessHeap () returned 0x560000 [0043.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.144] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c628 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c970 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c510 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cc8 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2e0 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.145] GetProcessHeap () returned 0x560000 [0043.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0043.145] WriteFile (in: hFile=0x230, lpBuffer=0x56e210*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e210*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0043.148] GetProcessHeap () returned 0x560000 [0043.148] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e210, Size=0x30) returned 0x56e210 [0043.149] GetProcessHeap () returned 0x560000 [0043.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.149] GetProcessHeap () returned 0x560000 [0043.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x910) returned 0x584298 [0043.149] ReadFile (in: hFile=0x230, lpBuffer=0x584298, nNumberOfBytesToRead=0x910, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x584298*, lpNumberOfBytesRead=0x24ad7e8*=0x910, lpOverlapped=0x0) returned 1 [0043.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.149] WriteFile (in: hFile=0x230, lpBuffer=0x584298*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x584298*, lpNumberOfBytesWritten=0x24ad7e4*=0x910, lpOverlapped=0x0) returned 1 [0043.150] GetProcessHeap () returned 0x560000 [0043.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584298 | out: hHeap=0x560000) returned 1 [0043.150] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.150] WriteFile (in: hFile=0x230, lpBuffer=0x56e210*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e210*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0043.151] CloseHandle (hObject=0x230) returned 1 [0043.152] GetProcessHeap () returned 0x560000 [0043.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0043.152] GetProcessHeap () returned 0x560000 [0043.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0043.152] GetProcessHeap () returned 0x560000 [0043.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0043.152] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0043.152] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.badday") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.badday" [0043.152] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.badday" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.badday"), dwFlags=0x1) returned 1 [0043.153] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0043.153] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0043.153] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" [0043.153] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html")) returned 0x20 [0043.153] GetProcessHeap () returned 0x560000 [0043.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0043.153] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0043.153] lstrcmpiW (lpString1="nxquery.cat", lpString2=".") returned 1 [0043.153] lstrcmpiW (lpString1="nxquery.cat", lpString2="..") returned 1 [0043.153] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0043.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.153] GetProcessHeap () returned 0x560000 [0043.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0043.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.cat", lpUsedDefaultChar=0x0) returned 12 [0043.153] lstrlenA (lpString="nxquery.cat") returned 11 [0043.153] lstrlenA (lpString=".badday") returned 7 [0043.153] lstrlenA (lpString=".badday") returned 7 [0043.153] lstrlenA (lpString="nxquery.cat") returned 11 [0043.153] lstrcmpiA (lpString1="ery.cat", lpString2=".badday") returned 1 [0043.153] lstrcmpiW (lpString1="nxquery.cat", lpString2="how_to_back_files.html") returned 1 [0043.153] lstrcmpiW (lpString1="nxquery.cat", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0043.153] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0043.153] lstrcmpiW (lpString1="nxquery.cat", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0043.154] GetProcessHeap () returned 0x560000 [0043.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0043.154] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0043.154] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=9910) returned 1 [0043.154] GetProcessHeap () returned 0x560000 [0043.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0043.154] GetProcessHeap () returned 0x560000 [0043.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0043.154] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned 47 [0043.154] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0043.154] GetProcessHeap () returned 0x560000 [0043.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0043.154] GetProcessHeap () returned 0x560000 [0043.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e248 [0043.154] lstrlenA (lpString="rsa_encrypt") returned 11 [0043.154] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0043.155] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0043.155] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0043.155] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0043.155] lstrlenA (lpString="010001") returned 6 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58c628 [0043.155] GetProcessHeap () returned 0x560000 [0043.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0e8 [0043.155] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c3f8 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bb38 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bf98 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cc8 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c740 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cb0 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586ba0 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cb0 | out: hHeap=0x560000) returned 1 [0043.156] GetProcessHeap () returned 0x560000 [0043.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bc50 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0043.157] GetProcessHeap () returned 0x560000 [0043.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.158] GetProcessHeap () returned 0x560000 [0043.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.158] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.159] GetProcessHeap () returned 0x560000 [0043.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.160] GetProcessHeap () returned 0x560000 [0043.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0043.160] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c740 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf98 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cc8 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c628 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3f8 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0043.161] GetProcessHeap () returned 0x560000 [0043.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0043.161] WriteFile (in: hFile=0x230, lpBuffer=0x56e248*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e248*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0043.239] GetProcessHeap () returned 0x560000 [0043.239] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e248, Size=0x30) returned 0x56e248 [0043.239] GetProcessHeap () returned 0x560000 [0043.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0043.239] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.239] GetProcessHeap () returned 0x560000 [0043.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x26b6) returned 0x59f338 [0043.241] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x26b6, lpOverlapped=0x0) returned 1 [0043.242] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0043.242] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x26b6, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x26b6, lpOverlapped=0x0) returned 1 [0044.028] GetProcessHeap () returned 0x560000 [0044.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0044.028] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.028] WriteFile (in: hFile=0x230, lpBuffer=0x56e248*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e248*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.029] CloseHandle (hObject=0x230) returned 1 [0044.033] GetProcessHeap () returned 0x560000 [0044.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0044.033] GetProcessHeap () returned 0x560000 [0044.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.034] GetProcessHeap () returned 0x560000 [0044.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.034] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0044.034] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.badday") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.badday" [0044.034] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.badday" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.badday"), dwFlags=0x1) returned 1 [0044.034] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0044.034] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0044.034] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" [0044.034] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html")) returned 0x20 [0044.035] GetProcessHeap () returned 0x560000 [0044.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.035] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0044.035] lstrcmpiW (lpString1="nxquery.inf", lpString2=".") returned 1 [0044.035] lstrcmpiW (lpString1="nxquery.inf", lpString2="..") returned 1 [0044.035] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0044.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.035] GetProcessHeap () returned 0x560000 [0044.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0044.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.inf", lpUsedDefaultChar=0x0) returned 12 [0044.035] lstrlenA (lpString="nxquery.inf") returned 11 [0044.035] lstrlenA (lpString=".badday") returned 7 [0044.035] lstrlenA (lpString=".badday") returned 7 [0044.035] lstrlenA (lpString="nxquery.inf") returned 11 [0044.035] lstrcmpiA (lpString1="ery.inf", lpString2=".badday") returned 1 [0044.035] lstrcmpiW (lpString1="nxquery.inf", lpString2="how_to_back_files.html") returned 1 [0044.035] lstrcmpiW (lpString1="nxquery.inf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.035] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.035] lstrcmpiW (lpString1="nxquery.inf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0044.035] GetProcessHeap () returned 0x560000 [0044.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0044.035] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.035] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1495) returned 1 [0044.036] GetProcessHeap () returned 0x560000 [0044.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.036] GetProcessHeap () returned 0x560000 [0044.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.036] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned 47 [0044.036] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.036] GetProcessHeap () returned 0x560000 [0044.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.036] GetProcessHeap () returned 0x560000 [0044.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x56e280 [0044.036] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.036] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.036] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.037] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.037] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.037] lstrlenA (lpString="010001") returned 6 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58bb38 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58be80 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c3f8 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58c740 [0044.037] GetProcessHeap () returned 0x560000 [0044.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.037] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cb0 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c510 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b60 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587410 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b60 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bd68 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.038] GetProcessHeap () returned 0x560000 [0044.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.039] GetProcessHeap () returned 0x560000 [0044.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.040] GetProcessHeap () returned 0x560000 [0044.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.040] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.041] GetProcessHeap () returned 0x560000 [0044.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.041] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3f8 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c510 | out: hHeap=0x560000) returned 1 [0044.042] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c740 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cb0 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be80 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.043] GetProcessHeap () returned 0x560000 [0044.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.043] WriteFile (in: hFile=0x230, lpBuffer=0x56e280*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e280*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0044.046] GetProcessHeap () returned 0x560000 [0044.046] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e280, Size=0x30) returned 0x56e280 [0044.046] GetProcessHeap () returned 0x560000 [0044.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.046] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.046] GetProcessHeap () returned 0x560000 [0044.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5e0) returned 0x59f338 [0044.046] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x5e0, lpOverlapped=0x0) returned 1 [0044.046] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.046] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x5e0, lpOverlapped=0x0) returned 1 [0044.047] GetProcessHeap () returned 0x560000 [0044.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0044.047] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.047] WriteFile (in: hFile=0x230, lpBuffer=0x56e280*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e280*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.050] CloseHandle (hObject=0x230) returned 1 [0044.051] GetProcessHeap () returned 0x560000 [0044.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0044.052] GetProcessHeap () returned 0x560000 [0044.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.052] GetProcessHeap () returned 0x560000 [0044.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.052] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0044.052] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.badday") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.badday" [0044.052] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.badday" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.badday"), dwFlags=0x1) returned 1 [0044.052] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0044.052] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0044.052] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" [0044.052] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html")) returned 0x20 [0044.052] GetProcessHeap () returned 0x560000 [0044.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.052] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0044.052] lstrcmpiW (lpString1="NXQuery.sys", lpString2=".") returned 1 [0044.053] lstrcmpiW (lpString1="NXQuery.sys", lpString2="..") returned 1 [0044.053] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" [0044.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.053] GetProcessHeap () returned 0x560000 [0044.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0044.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NXQuery.sys", lpUsedDefaultChar=0x0) returned 12 [0044.053] lstrlenA (lpString="NXQuery.sys") returned 11 [0044.053] lstrlenA (lpString=".badday") returned 7 [0044.053] lstrlenA (lpString=".badday") returned 7 [0044.053] lstrlenA (lpString="NXQuery.sys") returned 11 [0044.053] lstrcmpiA (lpString1="ery.sys", lpString2=".badday") returned 1 [0044.053] lstrcmpiW (lpString1="NXQuery.sys", lpString2="how_to_back_files.html") returned 1 [0044.053] lstrcmpiW (lpString1="NXQuery.sys", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.053] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.053] lstrcmpiW (lpString1="NXQuery.sys", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0044.053] GetProcessHeap () returned 0x560000 [0044.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0044.053] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.053] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=20656) returned 1 [0044.053] GetProcessHeap () returned 0x560000 [0044.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.053] GetProcessHeap () returned 0x560000 [0044.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.053] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned 47 [0044.053] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.054] GetProcessHeap () returned 0x560000 [0044.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.054] GetProcessHeap () returned 0x560000 [0044.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e2b8 [0044.054] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.054] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.054] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.054] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.054] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.054] GetProcessHeap () returned 0x560000 [0044.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.054] lstrlenA (lpString="010001") returned 6 [0044.054] GetProcessHeap () returned 0x560000 [0044.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0044.054] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58bd68 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c858 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c740 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bb38 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c50 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bf98 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.055] GetProcessHeap () returned 0x560000 [0044.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d58 [0044.055] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586ba0 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d58 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bc50 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.056] GetProcessHeap () returned 0x560000 [0044.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.057] GetProcessHeap () returned 0x560000 [0044.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.057] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.058] GetProcessHeap () returned 0x560000 [0044.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.058] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.059] GetProcessHeap () returned 0x560000 [0044.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.059] GetProcessHeap () returned 0x560000 [0044.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c740 | out: hHeap=0x560000) returned 1 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf98 | out: hHeap=0x560000) returned 1 [0044.060] GetProcessHeap () returned 0x560000 [0044.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0044.063] GetProcessHeap () returned 0x560000 [0044.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0044.063] GetProcessHeap () returned 0x560000 [0044.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c50 | out: hHeap=0x560000) returned 1 [0044.063] GetProcessHeap () returned 0x560000 [0044.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0044.064] GetProcessHeap () returned 0x560000 [0044.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0044.064] GetProcessHeap () returned 0x560000 [0044.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0044.064] GetProcessHeap () returned 0x560000 [0044.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0044.064] GetProcessHeap () returned 0x560000 [0044.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.064] GetProcessHeap () returned 0x560000 [0044.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.064] WriteFile (in: hFile=0x230, lpBuffer=0x56e2b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e2b8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0044.067] GetProcessHeap () returned 0x560000 [0044.067] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e2b8, Size=0x30) returned 0x56e2b8 [0044.067] GetProcessHeap () returned 0x560000 [0044.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.067] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.067] GetProcessHeap () returned 0x560000 [0044.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x50b0) returned 0x59f338 [0044.067] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x50b0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x50b0, lpOverlapped=0x0) returned 1 [0044.068] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.068] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x50b0, lpOverlapped=0x0) returned 1 [0044.097] GetProcessHeap () returned 0x560000 [0044.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0044.098] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.098] WriteFile (in: hFile=0x230, lpBuffer=0x56e2b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e2b8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.099] CloseHandle (hObject=0x230) returned 1 [0044.100] GetProcessHeap () returned 0x560000 [0044.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0044.101] GetProcessHeap () returned 0x560000 [0044.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.101] GetProcessHeap () returned 0x560000 [0044.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.101] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" [0044.101] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.badday") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.badday" [0044.101] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.badday" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys.badday"), dwFlags=0x1) returned 1 [0044.101] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0044.101] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0044.101] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" [0044.101] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_to_back_files.html")) returned 0x20 [0044.101] GetProcessHeap () returned 0x560000 [0044.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.101] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0044.102] FindClose (in: hFindFile=0x579848 | out: hFindFile=0x579848) returned 1 [0044.102] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\dll2\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0044.102] GetProcessHeap () returned 0x560000 [0044.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579308 | out: hHeap=0x560000) returned 1 [0044.102] GetProcessHeap () returned 0x560000 [0044.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.102] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\") returned 25 [0044.102] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\dll2\\*") returned="C:\\Windows10Upgrade\\dll2\\*" [0044.102] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579308 [0044.102] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.102] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.102] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.102] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.102] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0044.102] lstrcmpiW (lpString1="webservices.dll", lpString2=".") returned 1 [0044.102] lstrcmpiW (lpString1="webservices.dll", lpString2="..") returned 1 [0044.102] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll" [0044.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0044.102] GetProcessHeap () returned 0x560000 [0044.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0044.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webservices.dll", lpUsedDefaultChar=0x0) returned 16 [0044.102] lstrlenA (lpString="webservices.dll") returned 15 [0044.102] lstrlenA (lpString=".badday") returned 7 [0044.102] lstrlenA (lpString=".badday") returned 7 [0044.102] lstrlenA (lpString="webservices.dll") returned 15 [0044.102] lstrcmpiA (lpString1="ces.dll", lpString2=".badday") returned 1 [0044.102] lstrcmpiW (lpString1="webservices.dll", lpString2="how_to_back_files.html") returned 1 [0044.103] lstrcmpiW (lpString1="webservices.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.103] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.103] lstrcmpiW (lpString1="webservices.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0044.103] GetProcessHeap () returned 0x560000 [0044.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d288 [0044.103] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.103] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=754688) returned 1 [0044.103] GetProcessHeap () returned 0x560000 [0044.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.103] GetProcessHeap () returned 0x560000 [0044.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.103] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned 40 [0044.103] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.103] GetProcessHeap () returned 0x560000 [0044.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.103] GetProcessHeap () returned 0x560000 [0044.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e2f0 [0044.103] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.103] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.104] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.104] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.104] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.104] lstrlenA (lpString="010001") returned 6 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a068 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58c2e0 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0044.104] GetProcessHeap () returned 0x560000 [0044.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c858 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bf98 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58c970 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c38 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bb38 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589da0 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586e70 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589da0 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bc50 [0044.105] GetProcessHeap () returned 0x560000 [0044.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0044.105] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.106] GetProcessHeap () returned 0x560000 [0044.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.106] GetProcessHeap () returned 0x560000 [0044.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.107] GetProcessHeap () returned 0x560000 [0044.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.107] GetProcessHeap () returned 0x560000 [0044.109] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.109] GetProcessHeap () returned 0x560000 [0044.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.109] GetProcessHeap () returned 0x560000 [0044.109] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.109] GetProcessHeap () returned 0x560000 [0044.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.109] GetProcessHeap () returned 0x560000 [0044.109] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.110] GetProcessHeap () returned 0x560000 [0044.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.111] GetProcessHeap () returned 0x560000 [0044.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.111] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf98 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c970 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c38 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2e0 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.112] GetProcessHeap () returned 0x560000 [0044.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.112] WriteFile (in: hFile=0x230, lpBuffer=0x56e2f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e2f0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0044.118] GetProcessHeap () returned 0x560000 [0044.118] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e2f0, Size=0x30) returned 0x56e2f0 [0044.118] GetProcessHeap () returned 0x560000 [0044.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.119] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.119] GetProcessHeap () returned 0x560000 [0044.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb8400) returned 0x24b7020 [0044.132] ReadFile (in: hFile=0x230, lpBuffer=0x24b7020, nNumberOfBytesToRead=0xb8400, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b7020*, lpNumberOfBytesRead=0x24ad7e8*=0xb8400, lpOverlapped=0x0) returned 1 [0044.145] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.145] WriteFile (in: hFile=0x230, lpBuffer=0x24b7020*, nNumberOfBytesToWrite=0xb8400, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b7020*, lpNumberOfBytesWritten=0x24ad7e4*=0xb8400, lpOverlapped=0x0) returned 1 [0044.233] GetProcessHeap () returned 0x560000 [0044.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b7020 | out: hHeap=0x560000) returned 1 [0044.236] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.236] WriteFile (in: hFile=0x230, lpBuffer=0x56e2f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e2f0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.240] CloseHandle (hObject=0x230) returned 1 [0044.254] GetProcessHeap () returned 0x560000 [0044.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d288 | out: hHeap=0x560000) returned 1 [0044.255] GetProcessHeap () returned 0x560000 [0044.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.255] GetProcessHeap () returned 0x560000 [0044.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.255] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\dll2\\webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll" [0044.255] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll.badday") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll.badday" [0044.255] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll2\\webservices.dll.badday" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll.badday"), dwFlags=0x1) returned 1 [0044.255] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll2\\webservices.dll" | out: pszPath="C:\\Windows10Upgrade\\dll2") returned 1 [0044.255] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll2" | out: pszPath="C:\\Windows10Upgrade\\dll2\\") returned="" [0044.255] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\dll2\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\dll2\\how_to_back_files.html" [0044.255] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll2\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\dll2\\how_to_back_files.html")) returned 0xffffffff [0044.255] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll2\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\dll2\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0044.256] GetProcessHeap () returned 0x560000 [0044.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.256] GetProcessHeap () returned 0x560000 [0044.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.274] GetProcessHeap () returned 0x560000 [0044.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.274] GetProcessHeap () returned 0x560000 [0044.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.274] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0044.274] GetProcessHeap () returned 0x560000 [0044.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.274] GetProcessHeap () returned 0x560000 [0044.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.305] GetProcessHeap () returned 0x560000 [0044.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.305] GetProcessHeap () returned 0x560000 [0044.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.305] CloseHandle (hObject=0x230) returned 1 [0044.306] GetProcessHeap () returned 0x560000 [0044.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.306] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0044.306] FindClose (in: hFindFile=0x579308 | out: hFindFile=0x579308) returned 1 [0044.306] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\dll1\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0044.306] GetProcessHeap () returned 0x560000 [0044.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579708 | out: hHeap=0x560000) returned 1 [0044.306] GetProcessHeap () returned 0x560000 [0044.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0044.306] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\") returned 25 [0044.306] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\dll1\\*") returned="C:\\Windows10Upgrade\\dll1\\*" [0044.306] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579308 [0044.307] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.307] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.307] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.307] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.307] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0044.307] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2=".") returned 1 [0044.307] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="..") returned 1 [0044.307] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="cosqueryxp.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" [0044.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosqueryxp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.307] GetProcessHeap () returned 0x560000 [0044.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0044.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosqueryxp.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cosqueryxp.dll", lpUsedDefaultChar=0x0) returned 15 [0044.307] lstrlenA (lpString="cosqueryxp.dll") returned 14 [0044.307] lstrlenA (lpString=".badday") returned 7 [0044.307] lstrlenA (lpString=".badday") returned 7 [0044.307] lstrlenA (lpString="cosqueryxp.dll") returned 14 [0044.307] lstrcmpiA (lpString1="yxp.dll", lpString2=".badday") returned 1 [0044.307] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="how_to_back_files.html") returned -1 [0044.307] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.307] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.307] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0044.307] GetProcessHeap () returned 0x560000 [0044.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0044.307] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.308] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=132296) returned 1 [0044.308] GetProcessHeap () returned 0x560000 [0044.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.308] GetProcessHeap () returned 0x560000 [0044.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.308] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned 39 [0044.308] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.308] GetProcessHeap () returned 0x560000 [0044.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.308] GetProcessHeap () returned 0x560000 [0044.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56e328 [0044.308] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.308] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.309] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.309] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.309] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.309] lstrlenA (lpString="010001") returned 6 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x58bc50 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c970 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.309] GetProcessHeap () returned 0x560000 [0044.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c2e0 [0044.309] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x58bb38 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ea8 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58c628 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ec0 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0044.310] GetProcessHeap () returned 0x560000 [0044.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ec0 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x58bd68 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.311] GetProcessHeap () returned 0x560000 [0044.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.312] GetProcessHeap () returned 0x560000 [0044.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.312] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a078 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a078 | out: hHeap=0x560000) returned 1 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.313] GetProcessHeap () returned 0x560000 [0044.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.314] GetProcessHeap () returned 0x560000 [0044.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2e0 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c628 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd68 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ea8 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc50 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c970 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.315] GetProcessHeap () returned 0x560000 [0044.315] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.315] WriteFile (in: hFile=0x230, lpBuffer=0x56e328*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e328*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0044.318] GetProcessHeap () returned 0x560000 [0044.318] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e328, Size=0x30) returned 0x56e328 [0044.319] GetProcessHeap () returned 0x560000 [0044.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.319] GetProcessHeap () returned 0x560000 [0044.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x204d0) returned 0x59f338 [0044.321] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x204d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x204d0, lpOverlapped=0x0) returned 1 [0044.323] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.323] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x204d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x204d0, lpOverlapped=0x0) returned 1 [0044.404] GetProcessHeap () returned 0x560000 [0044.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0044.404] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.404] WriteFile (in: hFile=0x230, lpBuffer=0x56e328*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e328*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.405] CloseHandle (hObject=0x230) returned 1 [0044.408] GetProcessHeap () returned 0x560000 [0044.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0044.409] GetProcessHeap () returned 0x560000 [0044.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.409] GetProcessHeap () returned 0x560000 [0044.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.409] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" [0044.409] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll.badday") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll.badday" [0044.409] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll.badday" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll.badday"), dwFlags=0x1) returned 1 [0044.409] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" | out: pszPath="C:\\Windows10Upgrade\\dll1") returned 1 [0044.409] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll1" | out: pszPath="C:\\Windows10Upgrade\\dll1\\") returned="" [0044.409] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" [0044.409] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\dll1\\how_to_back_files.html")) returned 0xffffffff [0044.409] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\dll1\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0044.412] GetProcessHeap () returned 0x560000 [0044.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.412] GetProcessHeap () returned 0x560000 [0044.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.428] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.431] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.432] GetProcessHeap () returned 0x560000 [0044.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.432] GetProcessHeap () returned 0x560000 [0044.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.432] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0044.432] GetProcessHeap () returned 0x560000 [0044.432] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.433] GetProcessHeap () returned 0x560000 [0044.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.471] GetProcessHeap () returned 0x560000 [0044.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.471] GetProcessHeap () returned 0x560000 [0044.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.471] CloseHandle (hObject=0x230) returned 1 [0044.471] GetProcessHeap () returned 0x560000 [0044.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.471] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0044.471] lstrcmpiW (lpString1="wdscore.dll", lpString2=".") returned 1 [0044.471] lstrcmpiW (lpString1="wdscore.dll", lpString2="..") returned 1 [0044.471] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="wdscore.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll" [0044.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdscore.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.472] GetProcessHeap () returned 0x560000 [0044.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0044.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdscore.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wdscore.dll", lpUsedDefaultChar=0x0) returned 12 [0044.472] lstrlenA (lpString="wdscore.dll") returned 11 [0044.472] lstrlenA (lpString=".badday") returned 7 [0044.472] lstrlenA (lpString=".badday") returned 7 [0044.472] lstrlenA (lpString="wdscore.dll") returned 11 [0044.472] lstrcmpiA (lpString1="ore.dll", lpString2=".badday") returned 1 [0044.472] lstrcmpiW (lpString1="wdscore.dll", lpString2="how_to_back_files.html") returned 1 [0044.472] lstrcmpiW (lpString1="wdscore.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.472] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.472] lstrcmpiW (lpString1="wdscore.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0044.472] GetProcessHeap () returned 0x560000 [0044.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0044.472] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.472] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=241864) returned 1 [0044.472] GetProcessHeap () returned 0x560000 [0044.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.472] GetProcessHeap () returned 0x560000 [0044.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.472] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned 36 [0044.473] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.473] GetProcessHeap () returned 0x560000 [0044.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.473] GetProcessHeap () returned 0x560000 [0044.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x56e360 [0044.473] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.473] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.473] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.473] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.473] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.473] GetProcessHeap () returned 0x560000 [0044.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.473] lstrlenA (lpString="010001") returned 6 [0044.473] GetProcessHeap () returned 0x560000 [0044.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be98 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589de8 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c948 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0044.474] GetProcessHeap () returned 0x560000 [0044.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0044.474] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ce0 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c948 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ce0 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.475] GetProcessHeap () returned 0x560000 [0044.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.475] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.476] GetProcessHeap () returned 0x560000 [0044.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.477] GetProcessHeap () returned 0x560000 [0044.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.477] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.478] GetProcessHeap () returned 0x560000 [0044.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.478] GetProcessHeap () returned 0x560000 [0044.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589de8 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be98 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0044.479] GetProcessHeap () returned 0x560000 [0044.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.480] GetProcessHeap () returned 0x560000 [0044.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.480] WriteFile (in: hFile=0x230, lpBuffer=0x56e360*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e360*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0044.519] GetProcessHeap () returned 0x560000 [0044.519] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e360, Size=0x30) returned 0x56e360 [0044.519] GetProcessHeap () returned 0x560000 [0044.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.519] GetProcessHeap () returned 0x560000 [0044.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3b0c8) returned 0x59f338 [0044.521] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x3b0c8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x3b0c8, lpOverlapped=0x0) returned 1 [0044.525] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.525] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x3b0c8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x3b0c8, lpOverlapped=0x0) returned 1 [0044.593] GetProcessHeap () returned 0x560000 [0044.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0044.595] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.595] WriteFile (in: hFile=0x230, lpBuffer=0x56e360*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e360*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.600] CloseHandle (hObject=0x230) returned 1 [0044.604] GetProcessHeap () returned 0x560000 [0044.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0044.604] GetProcessHeap () returned 0x560000 [0044.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.604] GetProcessHeap () returned 0x560000 [0044.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.605] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\dll1\\wdscore.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll" [0044.605] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll.badday") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll.badday" [0044.605] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll1\\wdscore.dll.badday" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll.badday"), dwFlags=0x1) returned 1 [0044.605] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll1\\wdscore.dll" | out: pszPath="C:\\Windows10Upgrade\\dll1") returned 1 [0044.605] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll1" | out: pszPath="C:\\Windows10Upgrade\\dll1\\") returned="" [0044.605] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" [0044.605] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\dll1\\how_to_back_files.html")) returned 0x20 [0044.605] GetProcessHeap () returned 0x560000 [0044.605] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.605] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0044.606] lstrcmpiW (lpString1="webservices.dll", lpString2=".") returned 1 [0044.606] lstrcmpiW (lpString1="webservices.dll", lpString2="..") returned 1 [0044.606] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll" [0044.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0044.606] GetProcessHeap () returned 0x560000 [0044.606] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0044.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webservices.dll", lpUsedDefaultChar=0x0) returned 16 [0044.606] lstrlenA (lpString="webservices.dll") returned 15 [0044.606] lstrlenA (lpString=".badday") returned 7 [0044.606] lstrlenA (lpString=".badday") returned 7 [0044.606] lstrlenA (lpString="webservices.dll") returned 15 [0044.606] lstrcmpiA (lpString1="ces.dll", lpString2=".badday") returned 1 [0044.606] lstrcmpiW (lpString1="webservices.dll", lpString2="how_to_back_files.html") returned 1 [0044.606] lstrcmpiW (lpString1="webservices.dll", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.606] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.606] lstrcmpiW (lpString1="webservices.dll", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0044.606] GetProcessHeap () returned 0x560000 [0044.606] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0044.606] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.606] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=958152) returned 1 [0044.607] GetProcessHeap () returned 0x560000 [0044.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.607] GetProcessHeap () returned 0x560000 [0044.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.607] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned 40 [0044.607] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.607] GetProcessHeap () returned 0x560000 [0044.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.607] GetProcessHeap () returned 0x560000 [0044.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56e398 [0044.607] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.607] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.608] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.608] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.608] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.608] lstrlenA (lpString="010001") returned 6 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c9d8 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be08 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0044.608] GetProcessHeap () returned 0x560000 [0044.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.608] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bf0 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d40 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c318 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d40 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.609] GetProcessHeap () returned 0x560000 [0044.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.609] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.610] GetProcessHeap () returned 0x560000 [0044.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.611] GetProcessHeap () returned 0x560000 [0044.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0e8 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0e8 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.612] GetProcessHeap () returned 0x560000 [0044.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0044.613] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bf0 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be08 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.614] GetProcessHeap () returned 0x560000 [0044.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.614] WriteFile (in: hFile=0x230, lpBuffer=0x56e398*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e398*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0044.617] GetProcessHeap () returned 0x560000 [0044.617] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e398, Size=0x30) returned 0x56e398 [0044.617] GetProcessHeap () returned 0x560000 [0044.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.617] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.617] GetProcessHeap () returned 0x560000 [0044.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe9ed0) returned 0x24b6020 [0044.636] ReadFile (in: hFile=0x230, lpBuffer=0x24b6020, nNumberOfBytesToRead=0xe9ed0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24b6020*, lpNumberOfBytesRead=0x24ad7e8*=0xe9ed0, lpOverlapped=0x0) returned 1 [0044.651] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.651] WriteFile (in: hFile=0x230, lpBuffer=0x24b6020*, nNumberOfBytesToWrite=0xe9ed0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x24b6020*, lpNumberOfBytesWritten=0x24ad7e4*=0xe9ed0, lpOverlapped=0x0) returned 1 [0044.775] GetProcessHeap () returned 0x560000 [0044.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x24b6020 | out: hHeap=0x560000) returned 1 [0044.780] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.781] WriteFile (in: hFile=0x230, lpBuffer=0x56e398*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e398*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.782] CloseHandle (hObject=0x230) returned 1 [0044.797] GetProcessHeap () returned 0x560000 [0044.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0044.797] GetProcessHeap () returned 0x560000 [0044.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.797] GetProcessHeap () returned 0x560000 [0044.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.797] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\dll1\\webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll" [0044.797] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll.badday") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll.badday" [0044.797] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll1\\webservices.dll.badday" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll.badday"), dwFlags=0x1) returned 1 [0044.797] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll1\\webservices.dll" | out: pszPath="C:\\Windows10Upgrade\\dll1") returned 1 [0044.797] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll1" | out: pszPath="C:\\Windows10Upgrade\\dll1\\") returned="" [0044.797] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" [0044.797] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll1\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\dll1\\how_to_back_files.html")) returned 0x20 [0044.798] GetProcessHeap () returned 0x560000 [0044.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.798] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0044.798] FindClose (in: hFindFile=0x579308 | out: hFindFile=0x579308) returned 1 [0044.798] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Windows10Upgrade\\2052\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0044.798] GetProcessHeap () returned 0x560000 [0044.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579448 | out: hHeap=0x560000) returned 1 [0044.798] GetProcessHeap () returned 0x560000 [0044.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0044.798] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\") returned 25 [0044.798] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\2052\\*") returned="C:\\Windows10Upgrade\\2052\\*" [0044.798] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579308 [0044.798] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.798] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.798] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.798] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.798] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0044.798] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2=".") returned 1 [0044.798] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="..") returned 1 [0044.798] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="DWINTL20.DLL" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" [0044.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWINTL20.DLL", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.798] GetProcessHeap () returned 0x560000 [0044.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0044.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWINTL20.DLL", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWINTL20.DLL", lpUsedDefaultChar=0x0) returned 13 [0044.799] lstrlenA (lpString="DWINTL20.DLL") returned 12 [0044.799] lstrlenA (lpString=".badday") returned 7 [0044.799] lstrlenA (lpString=".badday") returned 7 [0044.799] lstrlenA (lpString="DWINTL20.DLL") returned 12 [0044.799] lstrcmpiA (lpString1="L20.DLL", lpString2=".badday") returned 1 [0044.799] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="how_to_back_files.html") returned -1 [0044.799] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.799] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.799] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0044.799] GetProcessHeap () returned 0x560000 [0044.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0044.799] CreateFileW (lpFileName="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.799] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=118472) returned 1 [0044.799] GetProcessHeap () returned 0x560000 [0044.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.799] GetProcessHeap () returned 0x560000 [0044.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.799] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned 37 [0044.799] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.799] GetProcessHeap () returned 0x560000 [0044.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.800] GetProcessHeap () returned 0x560000 [0044.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x56e3d0 [0044.800] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.800] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.800] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.800] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.800] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.800] GetProcessHeap () returned 0x560000 [0044.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.800] lstrlenA (lpString="010001") returned 6 [0044.800] GetProcessHeap () returned 0x560000 [0044.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0044.800] GetProcessHeap () returned 0x560000 [0044.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.800] GetProcessHeap () returned 0x560000 [0044.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586ec0 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b60 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c9d8 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e00 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.801] GetProcessHeap () returned 0x560000 [0044.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c1f8 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e00 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1f8 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.802] GetProcessHeap () returned 0x560000 [0044.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.803] GetProcessHeap () returned 0x560000 [0044.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.804] GetProcessHeap () returned 0x560000 [0044.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1a8 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1a8 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a068 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a068 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0044.805] GetProcessHeap () returned 0x560000 [0044.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0044.805] GetProcessHeap () returned 0x560000 [0044.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b60 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.806] GetProcessHeap () returned 0x560000 [0044.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.806] WriteFile (in: hFile=0x230, lpBuffer=0x56e3d0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e3d0*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0044.811] GetProcessHeap () returned 0x560000 [0044.811] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e3d0, Size=0x30) returned 0x56e3d0 [0044.811] GetProcessHeap () returned 0x560000 [0044.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.811] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.811] GetProcessHeap () returned 0x560000 [0044.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1ced0) returned 0x59f338 [0044.814] ReadFile (in: hFile=0x230, lpBuffer=0x59f338, nNumberOfBytesToRead=0x1ced0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesRead=0x24ad7e8*=0x1ced0, lpOverlapped=0x0) returned 1 [0044.817] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.817] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x1ced0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad7e4*=0x1ced0, lpOverlapped=0x0) returned 1 [0044.916] GetProcessHeap () returned 0x560000 [0044.916] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f338 | out: hHeap=0x560000) returned 1 [0044.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.916] WriteFile (in: hFile=0x230, lpBuffer=0x56e3d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e3d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0044.918] CloseHandle (hObject=0x230) returned 1 [0044.921] GetProcessHeap () returned 0x560000 [0044.921] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0044.921] GetProcessHeap () returned 0x560000 [0044.921] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.921] GetProcessHeap () returned 0x560000 [0044.921] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.921] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" [0044.921] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL", lpString2=".badday" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL.badday") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL.badday" [0044.921] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), lpNewFileName="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL.badday" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll.badday"), dwFlags=0x1) returned 1 [0044.922] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" | out: pszPath="C:\\Windows10Upgrade\\2052") returned 1 [0044.922] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\2052" | out: pszPath="C:\\Windows10Upgrade\\2052\\") returned="" [0044.922] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Windows10Upgrade\\2052\\how_to_back_files.html") returned="C:\\Windows10Upgrade\\2052\\how_to_back_files.html" [0044.922] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\2052\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\2052\\how_to_back_files.html")) returned 0xffffffff [0044.922] CreateFileW (lpFileName="C:\\Windows10Upgrade\\2052\\how_to_back_files.html" (normalized: "c:\\windows10upgrade\\2052\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0044.922] GetProcessHeap () returned 0x560000 [0044.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.922] GetProcessHeap () returned 0x560000 [0044.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.929] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.936] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.943] GetProcessHeap () returned 0x560000 [0044.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.943] GetProcessHeap () returned 0x560000 [0044.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.943] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0044.943] GetProcessHeap () returned 0x560000 [0044.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.943] GetProcessHeap () returned 0x560000 [0044.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.949] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.950] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0044.977] GetProcessHeap () returned 0x560000 [0044.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0044.978] GetProcessHeap () returned 0x560000 [0044.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0044.978] CloseHandle (hObject=0x230) returned 1 [0044.978] GetProcessHeap () returned 0x560000 [0044.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.978] FindNextFileW (in: hFindFile=0x579308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0044.978] FindClose (in: hFindFile=0x579308 | out: hFindFile=0x579308) returned 1 [0044.978] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0044.978] GetProcessHeap () returned 0x560000 [0044.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5768b8 | out: hHeap=0x560000) returned 1 [0044.978] GetProcessHeap () returned 0x560000 [0044.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0044.978] lstrlenW (lpString="C:\\Users\\") returned 9 [0044.978] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0044.978] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0044.978] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.978] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.978] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.978] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.979] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0044.979] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0044.979] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0044.979] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0044.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.979] GetProcessHeap () returned 0x560000 [0044.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0044.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="All Users", lpUsedDefaultChar=0x0) returned 10 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0044.979] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0044.980] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0044.980] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0044.980] GetProcessHeap () returned 0x560000 [0044.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a068 [0044.980] lstrlenW (lpString="C:\\Users\\All Users\\") returned 19 [0044.980] GetProcessHeap () returned 0x560000 [0044.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x28) returned 0x575750 [0044.980] lstrcpyW (in: lpString1=0x575750, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0044.980] GetProcessHeap () returned 0x560000 [0044.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.980] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0044.980] lstrcmpiW (lpString1="Default", lpString2=".") returned 1 [0044.980] lstrcmpiW (lpString1="Default", lpString2="..") returned 1 [0044.980] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0044.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.981] GetProcessHeap () returned 0x560000 [0044.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a198 [0044.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=-1, lpMultiByteStr=0x58a198, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default", lpUsedDefaultChar=0x0) returned 8 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0044.981] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0044.982] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0044.982] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0044.982] GetProcessHeap () returned 0x560000 [0044.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a078 [0044.983] lstrlenW (lpString="C:\\Users\\Default\\") returned 17 [0044.983] GetProcessHeap () returned 0x560000 [0044.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x24) returned 0x575870 [0044.983] lstrcpyW (in: lpString1=0x575870, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0044.983] GetProcessHeap () returned 0x560000 [0044.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.983] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0044.983] lstrcmpiW (lpString1="Default User", lpString2=".") returned 1 [0044.983] lstrcmpiW (lpString1="Default User", lpString2="..") returned 1 [0044.983] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0044.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default User", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.983] GetProcessHeap () returned 0x560000 [0044.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0044.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default User", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default User", lpUsedDefaultChar=0x0) returned 13 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0044.983] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0044.984] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0044.984] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0044.984] GetProcessHeap () returned 0x560000 [0044.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1a8 [0044.984] lstrlenW (lpString="C:\\Users\\Default User\\") returned 22 [0044.984] GetProcessHeap () returned 0x560000 [0044.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e) returned 0x582c98 [0044.984] lstrcpyW (in: lpString1=0x582c98, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0044.984] GetProcessHeap () returned 0x560000 [0044.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0044.985] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0044.985] lstrcmpiW (lpString1="Default.migrated", lpString2=".") returned 1 [0044.985] lstrcmpiW (lpString1="Default.migrated", lpString2="..") returned 1 [0044.985] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default.migrated" | out: lpString1="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0044.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default.migrated", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0044.985] GetProcessHeap () returned 0x560000 [0044.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576878 [0044.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default.migrated", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default.migrated", lpUsedDefaultChar=0x0) returned 17 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0044.985] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0044.986] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0044.986] lstrcatW (in: lpString1="C:\\Users\\Default.migrated", lpString2="\\" | out: lpString1="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0044.986] GetProcessHeap () returned 0x560000 [0044.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0e8 [0044.986] lstrlenW (lpString="C:\\Users\\Default.migrated\\") returned 26 [0044.986] GetProcessHeap () returned 0x560000 [0044.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579308 [0044.986] lstrcpyW (in: lpString1=0x579308, lpString2="C:\\Users\\Default.migrated\\" | out: lpString1="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0044.986] GetProcessHeap () returned 0x560000 [0044.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0044.986] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.986] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0044.986] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0044.986] lstrcatW (in: lpString1="C:\\Users\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0044.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.987] GetProcessHeap () returned 0x560000 [0044.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0044.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0044.987] lstrlenA (lpString="desktop.ini") returned 11 [0044.987] lstrlenA (lpString=".badday") returned 7 [0044.987] lstrlenA (lpString=".badday") returned 7 [0044.987] lstrlenA (lpString="desktop.ini") returned 11 [0044.987] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0044.987] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0044.987] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0044.987] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0044.987] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0044.987] GetProcessHeap () returned 0x560000 [0044.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0044.987] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0044.987] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=174) returned 1 [0044.987] GetProcessHeap () returned 0x560000 [0044.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0044.987] GetProcessHeap () returned 0x560000 [0044.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0044.987] lstrlenW (lpString="C:\\Users\\desktop.ini") returned 20 [0044.987] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0044.987] GetProcessHeap () returned 0x560000 [0044.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0044.987] GetProcessHeap () returned 0x560000 [0044.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x56e408 [0044.987] lstrlenA (lpString="rsa_encrypt") returned 11 [0044.988] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0044.988] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0044.988] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0044.988] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0044.988] GetProcessHeap () returned 0x560000 [0044.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0044.988] lstrlenA (lpString="010001") returned 6 [0044.988] GetProcessHeap () returned 0x560000 [0044.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0044.988] GetProcessHeap () returned 0x560000 [0044.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.988] GetProcessHeap () returned 0x560000 [0044.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c828 [0044.988] GetProcessHeap () returned 0x560000 [0044.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.988] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e60 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e78 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.989] GetProcessHeap () returned 0x560000 [0044.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0044.989] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c9d8 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e78 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.990] GetProcessHeap () returned 0x560000 [0044.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0044.991] GetProcessHeap () returned 0x560000 [0044.991] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0044.992] GetProcessHeap () returned 0x560000 [0044.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0044.992] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0044.993] GetProcessHeap () returned 0x560000 [0044.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e60 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c828 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0044.994] GetProcessHeap () returned 0x560000 [0044.994] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0044.994] WriteFile (in: hFile=0x230, lpBuffer=0x56e408*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e408*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0044.998] GetProcessHeap () returned 0x560000 [0044.998] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e408, Size=0x30) returned 0x56e408 [0044.998] GetProcessHeap () returned 0x560000 [0044.998] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0044.998] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.998] GetProcessHeap () returned 0x560000 [0044.998] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb0) returned 0x571ec8 [0044.998] ReadFile (in: hFile=0x230, lpBuffer=0x571ec8, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesRead=0x24ad7e8*=0xb0, lpOverlapped=0x0) returned 1 [0044.999] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0044.999] WriteFile (in: hFile=0x230, lpBuffer=0x571ec8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesWritten=0x24ad7e4*=0xb0, lpOverlapped=0x0) returned 1 [0044.999] GetProcessHeap () returned 0x560000 [0044.999] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0044.999] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.000] WriteFile (in: hFile=0x230, lpBuffer=0x56e408*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e408*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.001] CloseHandle (hObject=0x230) returned 1 [0045.002] GetProcessHeap () returned 0x560000 [0045.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0045.002] GetProcessHeap () returned 0x560000 [0045.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.002] GetProcessHeap () returned 0x560000 [0045.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.002] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0045.002] lstrcatW (in: lpString1="C:\\Users\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\desktop.ini.badday") returned="C:\\Users\\desktop.ini.badday" [0045.002] MoveFileExW (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\desktop.ini.badday" (normalized: "c:\\users\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.002] PathRemoveFileSpecW (in: pszPath="C:\\Users\\desktop.ini" | out: pszPath="C:\\Users") returned 1 [0045.002] PathAddBackslashW (in: pszPath="C:\\Users" | out: pszPath="C:\\Users\\") returned="" [0045.002] lstrcatW (in: lpString1="C:\\Users\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\how_to_back_files.html") returned="C:\\Users\\how_to_back_files.html" [0045.002] GetFileAttributesW (lpFileName="C:\\Users\\how_to_back_files.html" (normalized: "c:\\users\\how_to_back_files.html")) returned 0xffffffff [0045.003] CreateFileW (lpFileName="C:\\Users\\how_to_back_files.html" (normalized: "c:\\users\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.003] GetProcessHeap () returned 0x560000 [0045.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.003] GetProcessHeap () returned 0x560000 [0045.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.017] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.018] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.023] GetProcessHeap () returned 0x560000 [0045.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.023] GetProcessHeap () returned 0x560000 [0045.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.023] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.023] GetProcessHeap () returned 0x560000 [0045.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.023] GetProcessHeap () returned 0x560000 [0045.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.067] GetProcessHeap () returned 0x560000 [0045.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.067] GetProcessHeap () returned 0x560000 [0045.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.067] CloseHandle (hObject=0x230) returned 1 [0045.067] GetProcessHeap () returned 0x560000 [0045.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.068] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0045.068] lstrcmpiW (lpString1="FD1HVy", lpString2=".") returned 1 [0045.068] lstrcmpiW (lpString1="FD1HVy", lpString2="..") returned 1 [0045.068] lstrcatW (in: lpString1="C:\\Users\\", lpString2="FD1HVy" | out: lpString1="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0045.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FD1HVy", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.068] GetProcessHeap () returned 0x560000 [0045.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a118 [0045.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FD1HVy", cchWideChar=-1, lpMultiByteStr=0x58a118, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FD1HVy", lpUsedDefaultChar=0x0) returned 7 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0045.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.069] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.069] lstrcatW (in: lpString1="C:\\Users\\FD1HVy", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0045.069] GetProcessHeap () returned 0x560000 [0045.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1c8 [0045.069] lstrlenW (lpString="C:\\Users\\FD1HVy\\") returned 16 [0045.069] GetProcessHeap () returned 0x560000 [0045.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x22) returned 0x575a20 [0045.069] lstrcpyW (in: lpString1=0x575a20, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0045.069] GetProcessHeap () returned 0x560000 [0045.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.069] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x65dc486e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x65dc486e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0045.069] lstrcmpiW (lpString1="Public", lpString2=".") returned 1 [0045.070] lstrcmpiW (lpString1="Public", lpString2="..") returned 1 [0045.070] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.070] GetProcessHeap () returned 0x560000 [0045.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a138 [0045.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Public", cchWideChar=-1, lpMultiByteStr=0x58a138, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Public", lpUsedDefaultChar=0x0) returned 7 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.071] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0045.071] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.071] GetProcessHeap () returned 0x560000 [0045.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a038 [0045.071] lstrlenW (lpString="C:\\Users\\Public\\") returned 16 [0045.071] GetProcessHeap () returned 0x560000 [0045.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x22) returned 0x575840 [0045.071] lstrcpyW (in: lpString1=0x575840, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.071] GetProcessHeap () returned 0x560000 [0045.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.071] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x65dc486e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x65dc486e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0045.071] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.071] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.071] GetProcessHeap () returned 0x560000 [0045.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575840 | out: hHeap=0x560000) returned 1 [0045.072] GetProcessHeap () returned 0x560000 [0045.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.072] lstrlenW (lpString="C:\\Users\\Public\\") returned 16 [0045.072] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0045.072] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x65dc486e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x65dc486e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.072] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.072] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x65dc486e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x65dc486e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.072] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.072] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.072] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65dc486e, ftCreationTime.dwHighDateTime=0x1d5782b, ftLastAccessTime.dwLowDateTime=0x65dc486e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x662af6a8, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", cAlternateFileName="9707F8~1")) returned 1 [0045.072] lstrcmpiW (lpString1="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", lpString2=".") returned 1 [0045.072] lstrcmpiW (lpString1="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", lpString2="..") returned 1 [0045.072] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3" | out: lpString1="C:\\Users\\Public\\9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned="C:\\Users\\Public\\9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3" [0045.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0045.072] GetProcessHeap () returned 0x560000 [0045.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x41) returned 0x585a50 [0045.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", cchWideChar=-1, lpMultiByteStr=0x585a50, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", lpUsedDefaultChar=0x0) returned 65 [0045.072] lstrlenA (lpString="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 64 [0045.072] lstrlenA (lpString=".badday") returned 7 [0045.072] lstrlenA (lpString=".badday") returned 7 [0045.072] lstrlenA (lpString="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 64 [0045.072] lstrcmpiA (lpString1="5D7D8E3", lpString2=".badday") returned 1 [0045.072] lstrcmpiW (lpString1="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", lpString2="how_to_back_files.html") returned -1 [0045.072] lstrcmpiW (lpString1="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 0 [0045.072] GetProcessHeap () returned 0x560000 [0045.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585a50 | out: hHeap=0x560000) returned 1 [0045.072] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0045.072] lstrcmpiW (lpString1="AccountPictures", lpString2=".") returned 1 [0045.073] lstrcmpiW (lpString1="AccountPictures", lpString2="..") returned 1 [0045.073] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0045.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AccountPictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0045.073] GetProcessHeap () returned 0x560000 [0045.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0045.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AccountPictures", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccountPictures", lpUsedDefaultChar=0x0) returned 16 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.073] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.074] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0045.074] GetProcessHeap () returned 0x560000 [0045.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0045.074] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\") returned 32 [0045.074] GetProcessHeap () returned 0x560000 [0045.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x42) returned 0x585be0 [0045.074] lstrcpyW (in: lpString1=0x585be0, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0045.074] GetProcessHeap () returned 0x560000 [0045.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.074] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0045.074] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0045.074] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0045.074] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0045.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.074] GetProcessHeap () returned 0x560000 [0045.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a158 [0045.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x58a158, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop", lpUsedDefaultChar=0x0) returned 8 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0045.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.188] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0045.188] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.188] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.188] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.188] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.188] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.188] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0045.188] GetProcessHeap () returned 0x560000 [0045.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a178 [0045.188] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0045.188] GetProcessHeap () returned 0x560000 [0045.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x32) returned 0x579488 [0045.188] lstrcpyW (in: lpString1=0x579488, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0045.188] GetProcessHeap () returned 0x560000 [0045.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.188] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.188] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.188] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.188] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini" [0045.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.188] GetProcessHeap () returned 0x560000 [0045.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.189] lstrlenA (lpString="desktop.ini") returned 11 [0045.189] lstrlenA (lpString=".badday") returned 7 [0045.189] lstrlenA (lpString=".badday") returned 7 [0045.189] lstrlenA (lpString="desktop.ini") returned 11 [0045.189] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.189] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.189] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.189] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.189] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.189] GetProcessHeap () returned 0x560000 [0045.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0045.189] CreateFileW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.189] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=174) returned 1 [0045.189] GetProcessHeap () returned 0x560000 [0045.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.189] GetProcessHeap () returned 0x560000 [0045.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.189] lstrlenW (lpString="C:\\Users\\Public\\desktop.ini") returned 27 [0045.189] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.189] GetProcessHeap () returned 0x560000 [0045.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.189] GetProcessHeap () returned 0x560000 [0045.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x56e440 [0045.189] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.189] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x56e7d0) returned 1 [0045.190] CryptGenRandom (in: hProv=0x56e7d0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.190] CryptReleaseContext (hProv=0x56e7d0, dwFlags=0x0) returned 1 [0045.190] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.190] GetProcessHeap () returned 0x560000 [0045.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x56e7d0 [0045.190] lstrlenA (lpString="010001") returned 6 [0045.190] GetProcessHeap () returned 0x560000 [0045.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a038 [0045.190] GetProcessHeap () returned 0x560000 [0045.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.190] GetProcessHeap () returned 0x560000 [0045.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0045.190] GetProcessHeap () returned 0x560000 [0045.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.190] GetProcessHeap () returned 0x560000 [0045.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0045.190] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ce0 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be98 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be98 | out: hHeap=0x560000) returned 1 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b90 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c678 [0045.191] GetProcessHeap () returned 0x560000 [0045.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b90 | out: hHeap=0x560000) returned 1 [0045.191] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c678 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.192] GetProcessHeap () returned 0x560000 [0045.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.193] GetProcessHeap () returned 0x560000 [0045.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.194] GetProcessHeap () returned 0x560000 [0045.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.195] GetProcessHeap () returned 0x560000 [0045.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ce0 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.196] GetProcessHeap () returned 0x560000 [0045.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56e7d0 | out: hHeap=0x560000) returned 1 [0045.196] WriteFile (in: hFile=0x230, lpBuffer=0x56e440*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e440*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0045.206] GetProcessHeap () returned 0x560000 [0045.206] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e440, Size=0x30) returned 0x56e440 [0045.206] GetProcessHeap () returned 0x560000 [0045.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.207] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.207] GetProcessHeap () returned 0x560000 [0045.207] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb0) returned 0x571ec8 [0045.207] ReadFile (in: hFile=0x230, lpBuffer=0x571ec8, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesRead=0x24ad7e8*=0xb0, lpOverlapped=0x0) returned 1 [0045.207] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.207] WriteFile (in: hFile=0x230, lpBuffer=0x571ec8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesWritten=0x24ad7e4*=0xb0, lpOverlapped=0x0) returned 1 [0045.208] GetProcessHeap () returned 0x560000 [0045.208] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0045.208] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.208] WriteFile (in: hFile=0x230, lpBuffer=0x56e440*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e440*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.209] CloseHandle (hObject=0x230) returned 1 [0045.210] GetProcessHeap () returned 0x560000 [0045.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0045.210] GetProcessHeap () returned 0x560000 [0045.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.210] GetProcessHeap () returned 0x560000 [0045.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.210] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini" [0045.210] lstrcatW (in: lpString1="C:\\Users\\Public\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\desktop.ini.badday") returned="C:\\Users\\Public\\desktop.ini.badday" [0045.210] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\desktop.ini.badday" (normalized: "c:\\users\\public\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.211] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\desktop.ini" | out: pszPath="C:\\Users\\Public") returned 1 [0045.211] PathAddBackslashW (in: pszPath="C:\\Users\\Public" | out: pszPath="C:\\Users\\Public\\") returned="" [0045.211] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\how_to_back_files.html") returned="C:\\Users\\Public\\how_to_back_files.html" [0045.211] GetFileAttributesW (lpFileName="C:\\Users\\Public\\how_to_back_files.html" (normalized: "c:\\users\\public\\how_to_back_files.html")) returned 0xffffffff [0045.211] CreateFileW (lpFileName="C:\\Users\\Public\\how_to_back_files.html" (normalized: "c:\\users\\public\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.211] GetProcessHeap () returned 0x560000 [0045.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.211] GetProcessHeap () returned 0x560000 [0045.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.218] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.219] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.219] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.219] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.219] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.223] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.223] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.223] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.230] GetProcessHeap () returned 0x560000 [0045.230] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.230] GetProcessHeap () returned 0x560000 [0045.230] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.230] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.230] GetProcessHeap () returned 0x560000 [0045.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.230] GetProcessHeap () returned 0x560000 [0045.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.238] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.252] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.254] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.254] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.254] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.254] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.254] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.254] GetProcessHeap () returned 0x560000 [0045.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.254] GetProcessHeap () returned 0x560000 [0045.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.254] CloseHandle (hObject=0x230) returned 1 [0045.254] GetProcessHeap () returned 0x560000 [0045.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.255] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0045.255] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0045.255] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0045.255] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0045.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.255] GetProcessHeap () returned 0x560000 [0045.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0045.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents", lpUsedDefaultChar=0x0) returned 10 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0045.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.256] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0045.256] GetProcessHeap () returned 0x560000 [0045.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a008 [0045.256] lstrlenW (lpString="C:\\Users\\Public\\Documents\\") returned 26 [0045.256] GetProcessHeap () returned 0x560000 [0045.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x5794c8 [0045.256] lstrcpyW (in: lpString1=0x5794c8, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0045.256] GetProcessHeap () returned 0x560000 [0045.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.256] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0045.256] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0045.257] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0045.257] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0045.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.257] GetProcessHeap () returned 0x560000 [0045.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0045.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads", lpUsedDefaultChar=0x0) returned 10 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.258] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0045.258] GetProcessHeap () returned 0x560000 [0045.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a038 [0045.258] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\") returned 26 [0045.258] GetProcessHeap () returned 0x560000 [0045.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579688 [0045.258] lstrcpyW (in: lpString1=0x579688, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0045.258] GetProcessHeap () returned 0x560000 [0045.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.258] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0045.258] lstrcmpiW (lpString1="Libraries", lpString2=".") returned 1 [0045.258] lstrcmpiW (lpString1="Libraries", lpString2="..") returned 1 [0045.258] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0045.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Libraries", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.259] GetProcessHeap () returned 0x560000 [0045.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0045.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Libraries", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Libraries", lpUsedDefaultChar=0x0) returned 10 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.260] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0045.260] GetProcessHeap () returned 0x560000 [0045.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1b8 [0045.260] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\") returned 26 [0045.260] GetProcessHeap () returned 0x560000 [0045.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579508 [0045.260] lstrcpyW (in: lpString1=0x579508, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0045.260] GetProcessHeap () returned 0x560000 [0045.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.260] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0045.260] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0045.260] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0045.260] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0045.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.260] GetProcessHeap () returned 0x560000 [0045.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a088 [0045.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x58a088, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music", lpUsedDefaultChar=0x0) returned 6 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.262] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0045.262] GetProcessHeap () returned 0x560000 [0045.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a058 [0045.262] lstrlenW (lpString="C:\\Users\\Public\\Music\\") returned 22 [0045.262] GetProcessHeap () returned 0x560000 [0045.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e) returned 0x582b10 [0045.262] lstrcpyW (in: lpString1=0x582b10, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0045.262] GetProcessHeap () returned 0x560000 [0045.262] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.262] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0045.262] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0045.262] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0045.262] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0045.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.262] GetProcessHeap () returned 0x560000 [0045.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0045.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pictures", lpUsedDefaultChar=0x0) returned 9 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.262] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.263] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.265] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.265] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0045.265] GetProcessHeap () returned 0x560000 [0045.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a118 [0045.265] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\") returned 25 [0045.265] GetProcessHeap () returned 0x560000 [0045.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579608 [0045.265] lstrcpyW (in: lpString1=0x579608, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0045.265] GetProcessHeap () returned 0x560000 [0045.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.265] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0045.265] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0045.265] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0045.265] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0045.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.265] GetProcessHeap () returned 0x560000 [0045.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a088 [0045.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x58a088, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Videos", lpUsedDefaultChar=0x0) returned 7 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0045.266] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.267] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0045.267] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0045.267] GetProcessHeap () returned 0x560000 [0045.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a098 [0045.267] lstrlenW (lpString="C:\\Users\\Public\\Videos\\") returned 23 [0045.267] GetProcessHeap () returned 0x560000 [0045.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x30) returned 0x582918 [0045.267] lstrcpyW (in: lpString1=0x582918, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0045.267] GetProcessHeap () returned 0x560000 [0045.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0045.267] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.267] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0045.267] GetProcessHeap () returned 0x560000 [0045.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582918 | out: hHeap=0x560000) returned 1 [0045.267] GetProcessHeap () returned 0x560000 [0045.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.267] lstrlenW (lpString="C:\\Users\\Public\\Videos\\") returned 23 [0045.267] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0045.267] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.268] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.268] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.268] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.268] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.268] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.268] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.268] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.268] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini" [0045.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.268] GetProcessHeap () returned 0x560000 [0045.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.268] lstrlenA (lpString="desktop.ini") returned 11 [0045.268] lstrlenA (lpString=".badday") returned 7 [0045.268] lstrlenA (lpString=".badday") returned 7 [0045.268] lstrlenA (lpString="desktop.ini") returned 11 [0045.268] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.268] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.268] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.268] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.268] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.268] GetProcessHeap () returned 0x560000 [0045.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0045.268] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.269] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=380) returned 1 [0045.269] GetProcessHeap () returned 0x560000 [0045.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.269] GetProcessHeap () returned 0x560000 [0045.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.269] lstrlenW (lpString="C:\\Users\\Public\\Videos\\desktop.ini") returned 34 [0045.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.269] GetProcessHeap () returned 0x560000 [0045.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.269] GetProcessHeap () returned 0x560000 [0045.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x56e478 [0045.269] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.269] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.269] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.269] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.269] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.270] lstrlenA (lpString="010001") returned 6 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bd78 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c948 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b78 [0045.270] GetProcessHeap () returned 0x560000 [0045.270] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8b8 [0045.270] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8b8 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b90 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bbc8 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b90 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.271] GetProcessHeap () returned 0x560000 [0045.271] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.271] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.272] GetProcessHeap () returned 0x560000 [0045.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.272] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.273] GetProcessHeap () returned 0x560000 [0045.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.273] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.274] GetProcessHeap () returned 0x560000 [0045.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.275] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0045.275] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b78 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.276] GetProcessHeap () returned 0x560000 [0045.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.276] WriteFile (in: hFile=0x230, lpBuffer=0x56e478*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e478*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0045.280] GetProcessHeap () returned 0x560000 [0045.280] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e478, Size=0x30) returned 0x56e478 [0045.280] GetProcessHeap () returned 0x560000 [0045.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.280] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.280] GetProcessHeap () returned 0x560000 [0045.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x180) returned 0x5703a0 [0045.280] ReadFile (in: hFile=0x230, lpBuffer=0x5703a0, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesRead=0x24ad7e8*=0x180, lpOverlapped=0x0) returned 1 [0045.280] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.280] WriteFile (in: hFile=0x230, lpBuffer=0x5703a0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesWritten=0x24ad7e4*=0x180, lpOverlapped=0x0) returned 1 [0045.281] GetProcessHeap () returned 0x560000 [0045.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0045.281] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.281] WriteFile (in: hFile=0x230, lpBuffer=0x56e478*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e478*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.282] CloseHandle (hObject=0x230) returned 1 [0045.283] GetProcessHeap () returned 0x560000 [0045.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0045.283] GetProcessHeap () returned 0x560000 [0045.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.283] GetProcessHeap () returned 0x560000 [0045.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.283] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Videos\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini" [0045.283] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini.badday") returned="C:\\Users\\Public\\Videos\\desktop.ini.badday" [0045.283] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\desktop.ini.badday" (normalized: "c:\\users\\public\\videos\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.284] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Videos\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0045.284] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Videos" | out: pszPath="C:\\Users\\Public\\Videos\\") returned="" [0045.284] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Videos\\how_to_back_files.html") returned="C:\\Users\\Public\\Videos\\how_to_back_files.html" [0045.284] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\public\\videos\\how_to_back_files.html")) returned 0xffffffff [0045.284] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\public\\videos\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.284] GetProcessHeap () returned 0x560000 [0045.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.284] GetProcessHeap () returned 0x560000 [0045.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.305] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.305] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.305] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.305] GetProcessHeap () returned 0x560000 [0045.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.305] GetProcessHeap () returned 0x560000 [0045.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.305] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.305] GetProcessHeap () returned 0x560000 [0045.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.305] GetProcessHeap () returned 0x560000 [0045.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.312] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.313] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.314] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.322] GetProcessHeap () returned 0x560000 [0045.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.323] GetProcessHeap () returned 0x560000 [0045.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.323] CloseHandle (hObject=0x230) returned 1 [0045.323] GetProcessHeap () returned 0x560000 [0045.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.323] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.323] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.323] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0045.323] GetProcessHeap () returned 0x560000 [0045.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579608 | out: hHeap=0x560000) returned 1 [0045.323] GetProcessHeap () returned 0x560000 [0045.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.323] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\") returned 25 [0045.323] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0045.323] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.323] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.323] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.323] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.323] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.323] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.324] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.324] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.324] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini" [0045.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.324] GetProcessHeap () returned 0x560000 [0045.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.324] lstrlenA (lpString="desktop.ini") returned 11 [0045.324] lstrlenA (lpString=".badday") returned 7 [0045.324] lstrlenA (lpString=".badday") returned 7 [0045.324] lstrlenA (lpString="desktop.ini") returned 11 [0045.324] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.324] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.324] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.324] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.324] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.324] GetProcessHeap () returned 0x560000 [0045.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0045.324] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.324] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=380) returned 1 [0045.324] GetProcessHeap () returned 0x560000 [0045.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.324] GetProcessHeap () returned 0x560000 [0045.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.324] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\desktop.ini") returned 36 [0045.324] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.325] GetProcessHeap () returned 0x560000 [0045.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.325] GetProcessHeap () returned 0x560000 [0045.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x56e4b0 [0045.325] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.325] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.325] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.325] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.325] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.325] GetProcessHeap () returned 0x560000 [0045.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.325] lstrlenA (lpString="010001") returned 6 [0045.325] GetProcessHeap () returned 0x560000 [0045.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0045.326] GetProcessHeap () returned 0x560000 [0045.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.326] GetProcessHeap () returned 0x560000 [0045.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0045.326] GetProcessHeap () returned 0x560000 [0045.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.327] GetProcessHeap () returned 0x560000 [0045.327] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c678 [0045.327] GetProcessHeap () returned 0x560000 [0045.327] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0045.327] GetProcessHeap () returned 0x560000 [0045.327] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0045.327] GetProcessHeap () returned 0x560000 [0045.327] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0045.327] GetProcessHeap () returned 0x560000 [0045.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ef0 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e78 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c3a8 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e78 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0045.328] GetProcessHeap () returned 0x560000 [0045.328] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0045.328] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.329] GetProcessHeap () returned 0x560000 [0045.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.329] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.330] GetProcessHeap () returned 0x560000 [0045.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.331] GetProcessHeap () returned 0x560000 [0045.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.331] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.332] GetProcessHeap () returned 0x560000 [0045.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ef0 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c678 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.333] GetProcessHeap () returned 0x560000 [0045.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.333] WriteFile (in: hFile=0x230, lpBuffer=0x56e4b0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e4b0*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0045.339] GetProcessHeap () returned 0x560000 [0045.339] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56e4b0, Size=0x30) returned 0x56e4b0 [0045.339] GetProcessHeap () returned 0x560000 [0045.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.339] GetProcessHeap () returned 0x560000 [0045.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x180) returned 0x5703a0 [0045.339] ReadFile (in: hFile=0x230, lpBuffer=0x5703a0, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesRead=0x24ad7e8*=0x180, lpOverlapped=0x0) returned 1 [0045.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.339] WriteFile (in: hFile=0x230, lpBuffer=0x5703a0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesWritten=0x24ad7e4*=0x180, lpOverlapped=0x0) returned 1 [0045.340] GetProcessHeap () returned 0x560000 [0045.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0045.340] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.340] WriteFile (in: hFile=0x230, lpBuffer=0x56e4b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x56e4b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.341] CloseHandle (hObject=0x230) returned 1 [0045.342] GetProcessHeap () returned 0x560000 [0045.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0045.342] GetProcessHeap () returned 0x560000 [0045.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.342] GetProcessHeap () returned 0x560000 [0045.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.342] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Pictures\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini" [0045.342] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini.badday") returned="C:\\Users\\Public\\Pictures\\desktop.ini.badday" [0045.342] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\desktop.ini.badday" (normalized: "c:\\users\\public\\pictures\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.343] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Pictures\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0045.343] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Pictures" | out: pszPath="C:\\Users\\Public\\Pictures\\") returned="" [0045.343] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Pictures\\how_to_back_files.html") returned="C:\\Users\\Public\\Pictures\\how_to_back_files.html" [0045.343] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\public\\pictures\\how_to_back_files.html")) returned 0xffffffff [0045.343] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\public\\pictures\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.343] GetProcessHeap () returned 0x560000 [0045.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.343] GetProcessHeap () returned 0x560000 [0045.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.355] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.356] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.357] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.360] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.361] GetProcessHeap () returned 0x560000 [0045.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.361] GetProcessHeap () returned 0x560000 [0045.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.361] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.362] GetProcessHeap () returned 0x560000 [0045.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.362] GetProcessHeap () returned 0x560000 [0045.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.368] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.368] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.374] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.375] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.399] GetProcessHeap () returned 0x560000 [0045.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.399] GetProcessHeap () returned 0x560000 [0045.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.399] CloseHandle (hObject=0x230) returned 1 [0045.407] GetProcessHeap () returned 0x560000 [0045.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.407] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.407] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.407] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0045.407] GetProcessHeap () returned 0x560000 [0045.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582b10 | out: hHeap=0x560000) returned 1 [0045.407] GetProcessHeap () returned 0x560000 [0045.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.407] lstrlenW (lpString="C:\\Users\\Public\\Music\\") returned 22 [0045.407] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0045.407] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.407] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.407] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.407] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.407] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.407] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.407] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.408] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.408] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini" [0045.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.408] GetProcessHeap () returned 0x560000 [0045.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.408] lstrlenA (lpString="desktop.ini") returned 11 [0045.408] lstrlenA (lpString=".badday") returned 7 [0045.408] lstrlenA (lpString=".badday") returned 7 [0045.408] lstrlenA (lpString="desktop.ini") returned 11 [0045.408] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.408] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.408] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.408] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.408] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.408] GetProcessHeap () returned 0x560000 [0045.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0045.408] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.408] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=380) returned 1 [0045.408] GetProcessHeap () returned 0x560000 [0045.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.408] GetProcessHeap () returned 0x560000 [0045.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.408] lstrlenW (lpString="C:\\Users\\Public\\Music\\desktop.ini") returned 33 [0045.409] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.409] GetProcessHeap () returned 0x560000 [0045.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.409] GetProcessHeap () returned 0x560000 [0045.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x584298 [0045.409] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.409] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.409] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.409] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.409] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.409] GetProcessHeap () returned 0x560000 [0045.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.409] lstrlenA (lpString="010001") returned 6 [0045.409] GetProcessHeap () returned 0x560000 [0045.409] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8b8 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d58 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c0d8 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0045.410] GetProcessHeap () returned 0x560000 [0045.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d70 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bfb8 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d70 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfb8 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.411] GetProcessHeap () returned 0x560000 [0045.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.411] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.412] GetProcessHeap () returned 0x560000 [0045.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.412] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.413] GetProcessHeap () returned 0x560000 [0045.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.413] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.414] GetProcessHeap () returned 0x560000 [0045.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d58 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8b8 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.415] GetProcessHeap () returned 0x560000 [0045.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0045.416] GetProcessHeap () returned 0x560000 [0045.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0045.416] GetProcessHeap () returned 0x560000 [0045.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.416] GetProcessHeap () returned 0x560000 [0045.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.416] WriteFile (in: hFile=0x230, lpBuffer=0x584298*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x584298*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0045.433] GetProcessHeap () returned 0x560000 [0045.433] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x584298, Size=0x30) returned 0x584298 [0045.433] GetProcessHeap () returned 0x560000 [0045.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.433] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.433] GetProcessHeap () returned 0x560000 [0045.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x180) returned 0x5703a0 [0045.433] ReadFile (in: hFile=0x230, lpBuffer=0x5703a0, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesRead=0x24ad7e8*=0x180, lpOverlapped=0x0) returned 1 [0045.433] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.433] WriteFile (in: hFile=0x230, lpBuffer=0x5703a0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesWritten=0x24ad7e4*=0x180, lpOverlapped=0x0) returned 1 [0045.436] GetProcessHeap () returned 0x560000 [0045.436] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0045.436] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.436] WriteFile (in: hFile=0x230, lpBuffer=0x584298*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x584298*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.437] CloseHandle (hObject=0x230) returned 1 [0045.438] GetProcessHeap () returned 0x560000 [0045.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0045.438] GetProcessHeap () returned 0x560000 [0045.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.438] GetProcessHeap () returned 0x560000 [0045.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.438] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Music\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini" [0045.438] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini.badday") returned="C:\\Users\\Public\\Music\\desktop.ini.badday" [0045.438] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\desktop.ini.badday" (normalized: "c:\\users\\public\\music\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.439] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Music\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0045.439] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Music" | out: pszPath="C:\\Users\\Public\\Music\\") returned="" [0045.439] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Music\\how_to_back_files.html") returned="C:\\Users\\Public\\Music\\how_to_back_files.html" [0045.439] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\how_to_back_files.html" (normalized: "c:\\users\\public\\music\\how_to_back_files.html")) returned 0xffffffff [0045.439] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\how_to_back_files.html" (normalized: "c:\\users\\public\\music\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.440] GetProcessHeap () returned 0x560000 [0045.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.440] GetProcessHeap () returned 0x560000 [0045.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.464] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.466] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.468] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.469] GetProcessHeap () returned 0x560000 [0045.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.469] GetProcessHeap () returned 0x560000 [0045.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.469] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.469] GetProcessHeap () returned 0x560000 [0045.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.469] GetProcessHeap () returned 0x560000 [0045.469] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.482] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.504] GetProcessHeap () returned 0x560000 [0045.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.504] GetProcessHeap () returned 0x560000 [0045.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.504] CloseHandle (hObject=0x230) returned 1 [0045.505] GetProcessHeap () returned 0x560000 [0045.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.505] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.505] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.505] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0045.505] GetProcessHeap () returned 0x560000 [0045.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579508 | out: hHeap=0x560000) returned 1 [0045.505] GetProcessHeap () returned 0x560000 [0045.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.505] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\") returned 26 [0045.505] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0045.505] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.505] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.505] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.505] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.505] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.505] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.505] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.505] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.505] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini" [0045.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.506] GetProcessHeap () returned 0x560000 [0045.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.506] lstrlenA (lpString="desktop.ini") returned 11 [0045.506] lstrlenA (lpString=".badday") returned 7 [0045.506] lstrlenA (lpString=".badday") returned 7 [0045.506] lstrlenA (lpString="desktop.ini") returned 11 [0045.506] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.506] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.506] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.506] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.506] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.506] GetProcessHeap () returned 0x560000 [0045.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0045.506] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.506] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=175) returned 1 [0045.506] GetProcessHeap () returned 0x560000 [0045.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.506] GetProcessHeap () returned 0x560000 [0045.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.506] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\desktop.ini") returned 37 [0045.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.506] GetProcessHeap () returned 0x560000 [0045.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.507] GetProcessHeap () returned 0x560000 [0045.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x5842d0 [0045.507] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.507] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.507] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.507] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.507] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.507] GetProcessHeap () returned 0x560000 [0045.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.507] lstrlenA (lpString="010001") returned 6 [0045.507] GetProcessHeap () returned 0x560000 [0045.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0a8 [0045.507] GetProcessHeap () returned 0x560000 [0045.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.507] GetProcessHeap () returned 0x560000 [0045.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c948 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c20 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589da0 [0045.508] GetProcessHeap () returned 0x560000 [0045.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c0d8 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589da0 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.509] GetProcessHeap () returned 0x560000 [0045.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.509] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.510] GetProcessHeap () returned 0x560000 [0045.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.510] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.511] GetProcessHeap () returned 0x560000 [0045.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.512] GetProcessHeap () returned 0x560000 [0045.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.513] GetProcessHeap () returned 0x560000 [0045.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c20 | out: hHeap=0x560000) returned 1 [0045.524] GetProcessHeap () returned 0x560000 [0045.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0045.524] GetProcessHeap () returned 0x560000 [0045.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0045.524] GetProcessHeap () returned 0x560000 [0045.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0045.524] GetProcessHeap () returned 0x560000 [0045.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0045.524] GetProcessHeap () returned 0x560000 [0045.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.524] GetProcessHeap () returned 0x560000 [0045.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.524] WriteFile (in: hFile=0x230, lpBuffer=0x5842d0*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5842d0*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0045.529] GetProcessHeap () returned 0x560000 [0045.529] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5842d0, Size=0x30) returned 0x5842d0 [0045.529] GetProcessHeap () returned 0x560000 [0045.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.529] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.529] GetProcessHeap () returned 0x560000 [0045.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb0) returned 0x571ec8 [0045.529] ReadFile (in: hFile=0x230, lpBuffer=0x571ec8, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesRead=0x24ad7e8*=0xb0, lpOverlapped=0x0) returned 1 [0045.529] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.529] WriteFile (in: hFile=0x230, lpBuffer=0x571ec8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesWritten=0x24ad7e4*=0xb0, lpOverlapped=0x0) returned 1 [0045.537] GetProcessHeap () returned 0x560000 [0045.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0045.537] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.537] WriteFile (in: hFile=0x230, lpBuffer=0x5842d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5842d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.538] CloseHandle (hObject=0x230) returned 1 [0045.539] GetProcessHeap () returned 0x560000 [0045.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0045.539] GetProcessHeap () returned 0x560000 [0045.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.539] GetProcessHeap () returned 0x560000 [0045.539] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.539] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Libraries\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini" [0045.539] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini.badday") returned="C:\\Users\\Public\\Libraries\\desktop.ini.badday" [0045.539] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Libraries\\desktop.ini.badday" (normalized: "c:\\users\\public\\libraries\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.540] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Libraries\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Libraries") returned 1 [0045.540] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Libraries" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned="" [0045.540] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Libraries\\how_to_back_files.html") returned="C:\\Users\\Public\\Libraries\\how_to_back_files.html" [0045.540] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\how_to_back_files.html" (normalized: "c:\\users\\public\\libraries\\how_to_back_files.html")) returned 0xffffffff [0045.540] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\how_to_back_files.html" (normalized: "c:\\users\\public\\libraries\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.542] GetProcessHeap () returned 0x560000 [0045.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.542] GetProcessHeap () returned 0x560000 [0045.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.553] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.576] GetProcessHeap () returned 0x560000 [0045.576] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.576] GetProcessHeap () returned 0x560000 [0045.576] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.576] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.576] GetProcessHeap () returned 0x560000 [0045.576] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.576] GetProcessHeap () returned 0x560000 [0045.577] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.617] GetProcessHeap () returned 0x560000 [0045.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.617] GetProcessHeap () returned 0x560000 [0045.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.617] CloseHandle (hObject=0x230) returned 1 [0045.617] GetProcessHeap () returned 0x560000 [0045.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.617] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0045.617] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".") returned 1 [0045.617] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="..") returned 1 [0045.618] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0045.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0045.618] GetProcessHeap () returned 0x560000 [0045.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x5769f8 [0045.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RecordedTV.library-ms", lpUsedDefaultChar=0x0) returned 22 [0045.618] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0045.618] lstrlenA (lpString=".badday") returned 7 [0045.618] lstrlenA (lpString=".badday") returned 7 [0045.618] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0045.618] lstrcmpiA (lpString1="rary-ms", lpString2=".badday") returned 1 [0045.618] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="how_to_back_files.html") returned 1 [0045.618] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.618] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.618] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0045.618] GetProcessHeap () returned 0x560000 [0045.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0045.618] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.618] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=960) returned 1 [0045.618] GetProcessHeap () returned 0x560000 [0045.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.618] GetProcessHeap () returned 0x560000 [0045.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.618] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned 47 [0045.618] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.618] GetProcessHeap () returned 0x560000 [0045.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.619] GetProcessHeap () returned 0x560000 [0045.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x584308 [0045.619] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.619] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.619] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.619] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.620] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.620] lstrlenA (lpString="010001") returned 6 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586ec0 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0045.620] GetProcessHeap () returned 0x560000 [0045.620] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca68 [0045.620] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589dd0 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bd78 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589dd0 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.621] GetProcessHeap () returned 0x560000 [0045.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.621] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.622] GetProcessHeap () returned 0x560000 [0045.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.623] GetProcessHeap () returned 0x560000 [0045.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.627] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.628] GetProcessHeap () returned 0x560000 [0045.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.628] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.629] GetProcessHeap () returned 0x560000 [0045.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.630] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.630] GetProcessHeap () returned 0x560000 [0045.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0045.631] GetProcessHeap () returned 0x560000 [0045.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0045.631] GetProcessHeap () returned 0x560000 [0045.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0045.631] GetProcessHeap () returned 0x560000 [0045.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.631] GetProcessHeap () returned 0x560000 [0045.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.631] GetProcessHeap () returned 0x560000 [0045.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.631] WriteFile (in: hFile=0x230, lpBuffer=0x584308*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x584308*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0045.635] GetProcessHeap () returned 0x560000 [0045.635] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x584308, Size=0x30) returned 0x584308 [0045.635] GetProcessHeap () returned 0x560000 [0045.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.635] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.635] GetProcessHeap () returned 0x560000 [0045.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3c0) returned 0x584340 [0045.635] ReadFile (in: hFile=0x230, lpBuffer=0x584340, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x584340*, lpNumberOfBytesRead=0x24ad7e8*=0x3c0, lpOverlapped=0x0) returned 1 [0045.635] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.635] WriteFile (in: hFile=0x230, lpBuffer=0x584340*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x584340*, lpNumberOfBytesWritten=0x24ad7e4*=0x3c0, lpOverlapped=0x0) returned 1 [0045.636] GetProcessHeap () returned 0x560000 [0045.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584340 | out: hHeap=0x560000) returned 1 [0045.636] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.636] WriteFile (in: hFile=0x230, lpBuffer=0x584308*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x584308*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.637] CloseHandle (hObject=0x230) returned 1 [0045.638] GetProcessHeap () returned 0x560000 [0045.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0045.638] GetProcessHeap () returned 0x560000 [0045.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.638] GetProcessHeap () returned 0x560000 [0045.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.638] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0045.638] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.badday") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.badday" [0045.638] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.badday" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.badday"), dwFlags=0x1) returned 1 [0045.639] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: pszPath="C:\\Users\\Public\\Libraries") returned 1 [0045.639] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Libraries" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned="" [0045.639] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Libraries\\how_to_back_files.html") returned="C:\\Users\\Public\\Libraries\\how_to_back_files.html" [0045.639] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\how_to_back_files.html" (normalized: "c:\\users\\public\\libraries\\how_to_back_files.html")) returned 0x20 [0045.639] GetProcessHeap () returned 0x560000 [0045.639] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0045.639] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0045.639] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.639] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0045.639] GetProcessHeap () returned 0x560000 [0045.639] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579688 | out: hHeap=0x560000) returned 1 [0045.639] GetProcessHeap () returned 0x560000 [0045.639] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.640] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\") returned 26 [0045.640] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0045.640] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579848 [0045.640] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.640] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.640] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.640] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.640] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.640] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.640] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.640] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini" [0045.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.640] GetProcessHeap () returned 0x560000 [0045.640] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.640] lstrlenA (lpString="desktop.ini") returned 11 [0045.640] lstrlenA (lpString=".badday") returned 7 [0045.640] lstrlenA (lpString=".badday") returned 7 [0045.640] lstrlenA (lpString="desktop.ini") returned 11 [0045.640] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.640] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.640] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.640] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.640] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.640] GetProcessHeap () returned 0x560000 [0045.640] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0045.641] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.641] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=174) returned 1 [0045.641] GetProcessHeap () returned 0x560000 [0045.641] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.641] GetProcessHeap () returned 0x560000 [0045.641] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.641] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\desktop.ini") returned 37 [0045.641] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.641] GetProcessHeap () returned 0x560000 [0045.641] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.641] GetProcessHeap () returned 0x560000 [0045.641] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x59f338 [0045.641] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.641] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.642] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.642] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.642] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.642] lstrlenA (lpString="010001") returned 6 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3a8 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0045.642] GetProcessHeap () returned 0x560000 [0045.642] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.642] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d88 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c0d8 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c38 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bd78 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c38 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.643] GetProcessHeap () returned 0x560000 [0045.643] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.643] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.644] GetProcessHeap () returned 0x560000 [0045.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.644] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.645] GetProcessHeap () returned 0x560000 [0045.645] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.645] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.646] GetProcessHeap () returned 0x560000 [0045.646] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.646] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0045.647] GetProcessHeap () returned 0x560000 [0045.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d88 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.648] GetProcessHeap () returned 0x560000 [0045.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.648] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0045.652] GetProcessHeap () returned 0x560000 [0045.652] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59f338, Size=0x30) returned 0x59f338 [0045.652] GetProcessHeap () returned 0x560000 [0045.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.652] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.652] GetProcessHeap () returned 0x560000 [0045.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb0) returned 0x571ec8 [0045.652] ReadFile (in: hFile=0x230, lpBuffer=0x571ec8, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesRead=0x24ad7e8*=0xb0, lpOverlapped=0x0) returned 1 [0045.652] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.652] WriteFile (in: hFile=0x230, lpBuffer=0x571ec8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesWritten=0x24ad7e4*=0xb0, lpOverlapped=0x0) returned 1 [0045.653] GetProcessHeap () returned 0x560000 [0045.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0045.653] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.653] WriteFile (in: hFile=0x230, lpBuffer=0x59f338*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59f338*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.656] CloseHandle (hObject=0x230) returned 1 [0045.657] GetProcessHeap () returned 0x560000 [0045.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0045.657] GetProcessHeap () returned 0x560000 [0045.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.657] GetProcessHeap () returned 0x560000 [0045.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.657] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Downloads\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini" [0045.657] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini.badday") returned="C:\\Users\\Public\\Downloads\\desktop.ini.badday" [0045.658] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Downloads\\desktop.ini.badday" (normalized: "c:\\users\\public\\downloads\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.658] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Downloads\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Downloads") returned 1 [0045.658] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Downloads" | out: pszPath="C:\\Users\\Public\\Downloads\\") returned="" [0045.658] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Downloads\\how_to_back_files.html") returned="C:\\Users\\Public\\Downloads\\how_to_back_files.html" [0045.658] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Downloads\\how_to_back_files.html" (normalized: "c:\\users\\public\\downloads\\how_to_back_files.html")) returned 0xffffffff [0045.658] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\how_to_back_files.html" (normalized: "c:\\users\\public\\downloads\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.658] GetProcessHeap () returned 0x560000 [0045.658] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.658] GetProcessHeap () returned 0x560000 [0045.658] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.665] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.668] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.669] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.669] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.670] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.672] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.674] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.676] GetProcessHeap () returned 0x560000 [0045.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.677] GetProcessHeap () returned 0x560000 [0045.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.677] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.677] GetProcessHeap () returned 0x560000 [0045.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.677] GetProcessHeap () returned 0x560000 [0045.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.683] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.684] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.685] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.686] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.690] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.706] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.707] GetProcessHeap () returned 0x560000 [0045.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.707] GetProcessHeap () returned 0x560000 [0045.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.707] CloseHandle (hObject=0x230) returned 1 [0045.707] GetProcessHeap () returned 0x560000 [0045.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.707] FindNextFileW (in: hFindFile=0x579848, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.707] FindClose (in: hFindFile=0x579848 | out: hFindFile=0x579848) returned 1 [0045.707] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0045.707] GetProcessHeap () returned 0x560000 [0045.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5794c8 | out: hHeap=0x560000) returned 1 [0045.707] GetProcessHeap () returned 0x560000 [0045.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.707] lstrlenW (lpString="C:\\Users\\Public\\Documents\\") returned 26 [0045.707] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0045.707] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579608 [0045.709] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.709] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.709] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.709] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.709] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.709] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.709] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.709] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini" [0045.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.709] GetProcessHeap () returned 0x560000 [0045.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.709] lstrlenA (lpString="desktop.ini") returned 11 [0045.709] lstrlenA (lpString=".badday") returned 7 [0045.709] lstrlenA (lpString=".badday") returned 7 [0045.709] lstrlenA (lpString="desktop.ini") returned 11 [0045.709] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.709] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.709] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.709] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.709] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.709] GetProcessHeap () returned 0x560000 [0045.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0045.710] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.710] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=278) returned 1 [0045.710] GetProcessHeap () returned 0x560000 [0045.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.710] GetProcessHeap () returned 0x560000 [0045.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.710] lstrlenW (lpString="C:\\Users\\Public\\Documents\\desktop.ini") returned 37 [0045.710] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.710] GetProcessHeap () returned 0x560000 [0045.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.710] GetProcessHeap () returned 0x560000 [0045.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38a) returned 0x59f370 [0045.711] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.711] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.711] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.711] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.711] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.711] GetProcessHeap () returned 0x560000 [0045.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.711] lstrlenA (lpString="010001") returned 6 [0045.711] GetProcessHeap () returned 0x560000 [0045.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0045.711] GetProcessHeap () returned 0x560000 [0045.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.711] GetProcessHeap () returned 0x560000 [0045.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0045.711] GetProcessHeap () returned 0x560000 [0045.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c20 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c288 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c288 | out: hHeap=0x560000) returned 1 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e30 [0045.712] GetProcessHeap () returned 0x560000 [0045.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bfb8 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e30 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfb8 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.713] GetProcessHeap () returned 0x560000 [0045.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.713] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.714] GetProcessHeap () returned 0x560000 [0045.714] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.715] GetProcessHeap () returned 0x560000 [0045.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.715] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.716] GetProcessHeap () returned 0x560000 [0045.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.717] GetProcessHeap () returned 0x560000 [0045.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.717] GetProcessHeap () returned 0x560000 [0045.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.717] GetProcessHeap () returned 0x560000 [0045.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.717] GetProcessHeap () returned 0x560000 [0045.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.717] GetProcessHeap () returned 0x560000 [0045.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.717] GetProcessHeap () returned 0x560000 [0045.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c20 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.718] GetProcessHeap () returned 0x560000 [0045.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.718] WriteFile (in: hFile=0x230, lpBuffer=0x59f370*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59f370*, lpNumberOfBytesWritten=0x24ad864*=0x38a, lpOverlapped=0x0) returned 1 [0045.722] GetProcessHeap () returned 0x560000 [0045.722] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59f370, Size=0x30) returned 0x59f370 [0045.722] GetProcessHeap () returned 0x560000 [0045.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.722] GetProcessHeap () returned 0x560000 [0045.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x120) returned 0x585348 [0045.722] ReadFile (in: hFile=0x230, lpBuffer=0x585348, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x585348*, lpNumberOfBytesRead=0x24ad7e8*=0x120, lpOverlapped=0x0) returned 1 [0045.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.722] WriteFile (in: hFile=0x230, lpBuffer=0x585348*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x585348*, lpNumberOfBytesWritten=0x24ad7e4*=0x120, lpOverlapped=0x0) returned 1 [0045.723] GetProcessHeap () returned 0x560000 [0045.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585348 | out: hHeap=0x560000) returned 1 [0045.724] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.724] WriteFile (in: hFile=0x230, lpBuffer=0x59f370*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59f370*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.724] CloseHandle (hObject=0x230) returned 1 [0045.725] GetProcessHeap () returned 0x560000 [0045.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0045.726] GetProcessHeap () returned 0x560000 [0045.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.726] GetProcessHeap () returned 0x560000 [0045.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.726] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Documents\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini" [0045.726] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini.badday") returned="C:\\Users\\Public\\Documents\\desktop.ini.badday" [0045.726] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Documents\\desktop.ini.badday" (normalized: "c:\\users\\public\\documents\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.726] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Documents\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0045.726] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Documents" | out: pszPath="C:\\Users\\Public\\Documents\\") returned="" [0045.726] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Documents\\how_to_back_files.html") returned="C:\\Users\\Public\\Documents\\how_to_back_files.html" [0045.726] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\public\\documents\\how_to_back_files.html")) returned 0xffffffff [0045.726] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\public\\documents\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.727] GetProcessHeap () returned 0x560000 [0045.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.727] GetProcessHeap () returned 0x560000 [0045.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.745] GetProcessHeap () returned 0x560000 [0045.745] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.745] GetProcessHeap () returned 0x560000 [0045.745] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.745] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.745] GetProcessHeap () returned 0x560000 [0045.745] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.745] GetProcessHeap () returned 0x560000 [0045.745] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.785] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.787] GetProcessHeap () returned 0x560000 [0045.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.787] GetProcessHeap () returned 0x560000 [0045.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.787] CloseHandle (hObject=0x230) returned 1 [0045.788] GetProcessHeap () returned 0x560000 [0045.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.788] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0045.788] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0045.788] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0045.788] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0045.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.788] GetProcessHeap () returned 0x560000 [0045.788] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0045.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Music", lpUsedDefaultChar=0x0) returned 9 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.789] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0045.789] GetProcessHeap () returned 0x560000 [0045.789] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a158 [0045.790] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Music\\") returned 35 [0045.790] GetProcessHeap () returned 0x560000 [0045.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x48) returned 0x585cd0 [0045.790] lstrcpyW (in: lpString1=0x585cd0, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0045.790] GetProcessHeap () returned 0x560000 [0045.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.790] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0045.790] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0045.790] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0045.790] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0045.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.790] GetProcessHeap () returned 0x560000 [0045.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Pictures", lpUsedDefaultChar=0x0) returned 12 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.791] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0045.791] GetProcessHeap () returned 0x560000 [0045.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a008 [0045.791] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Pictures\\") returned 38 [0045.791] GetProcessHeap () returned 0x560000 [0045.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4e) returned 0x59ee18 [0045.791] lstrcpyW (in: lpString1=0x59ee18, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0045.791] GetProcessHeap () returned 0x560000 [0045.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.792] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0045.792] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0045.792] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0045.792] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0045.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.792] GetProcessHeap () returned 0x560000 [0045.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0045.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Videos", lpUsedDefaultChar=0x0) returned 10 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0045.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0045.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0045.793] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0045.793] GetProcessHeap () returned 0x560000 [0045.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a038 [0045.793] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Videos\\") returned 36 [0045.793] GetProcessHeap () returned 0x560000 [0045.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4a) returned 0x59f1e0 [0045.793] lstrcpyW (in: lpString1=0x59f1e0, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0045.793] GetProcessHeap () returned 0x560000 [0045.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.793] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0045.793] FindClose (in: hFindFile=0x579608 | out: hFindFile=0x579608) returned 1 [0045.794] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0045.794] GetProcessHeap () returned 0x560000 [0045.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f1e0 | out: hHeap=0x560000) returned 1 [0045.794] GetProcessHeap () returned 0x560000 [0045.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.794] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Videos\\") returned 36 [0045.794] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0045.794] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0045.795] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0045.795] GetProcessHeap () returned 0x560000 [0045.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ee18 | out: hHeap=0x560000) returned 1 [0045.795] GetProcessHeap () returned 0x560000 [0045.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.795] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Pictures\\") returned 38 [0045.795] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0045.795] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0045.795] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0045.795] GetProcessHeap () returned 0x560000 [0045.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585cd0 | out: hHeap=0x560000) returned 1 [0045.795] GetProcessHeap () returned 0x560000 [0045.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.796] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Music\\") returned 35 [0045.796] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0045.796] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0045.796] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0045.796] GetProcessHeap () returned 0x560000 [0045.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579488 | out: hHeap=0x560000) returned 1 [0045.796] GetProcessHeap () returned 0x560000 [0045.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.796] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0045.796] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0045.796] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.796] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.796] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.796] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.796] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.796] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0045.796] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2=".") returned 1 [0045.796] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="..") returned 1 [0045.796] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" [0045.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Acrobat Reader DC.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0045.796] GetProcessHeap () returned 0x560000 [0045.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576a98 [0045.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Acrobat Reader DC.lnk", cchWideChar=-1, lpMultiByteStr=0x576a98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrobat Reader DC.lnk", lpUsedDefaultChar=0x0) returned 22 [0045.796] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0045.796] lstrlenA (lpString=".badday") returned 7 [0045.796] lstrlenA (lpString=".badday") returned 7 [0045.797] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0045.797] lstrcmpiA (lpString1=" DC.lnk", lpString2=".badday") returned -1 [0045.797] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="how_to_back_files.html") returned -1 [0045.797] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.797] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.797] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.797] GetProcessHeap () returned 0x560000 [0045.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0045.797] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.797] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2130) returned 1 [0045.797] GetProcessHeap () returned 0x560000 [0045.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.797] GetProcessHeap () returned 0x560000 [0045.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.797] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned 45 [0045.797] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.797] GetProcessHeap () returned 0x560000 [0045.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.797] GetProcessHeap () returned 0x560000 [0045.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x58db20 [0045.797] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.797] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.798] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.798] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.798] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.798] lstrlenA (lpString="010001") returned 6 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0045.798] GetProcessHeap () returned 0x560000 [0045.798] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0045.798] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589de8 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c708 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589de8 | out: hHeap=0x560000) returned 1 [0045.799] GetProcessHeap () returned 0x560000 [0045.799] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0045.799] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.800] GetProcessHeap () returned 0x560000 [0045.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.800] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.801] GetProcessHeap () returned 0x560000 [0045.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.802] GetProcessHeap () returned 0x560000 [0045.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.803] GetProcessHeap () returned 0x560000 [0045.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.804] GetProcessHeap () returned 0x560000 [0045.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.804] WriteFile (in: hFile=0x230, lpBuffer=0x58db20*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58db20*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0045.806] GetProcessHeap () returned 0x560000 [0045.806] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58db20, Size=0x30) returned 0x58db20 [0045.806] GetProcessHeap () returned 0x560000 [0045.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.806] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.806] GetProcessHeap () returned 0x560000 [0045.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x860) returned 0x58db58 [0045.806] ReadFile (in: hFile=0x230, lpBuffer=0x58db58, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58db58*, lpNumberOfBytesRead=0x24ad7e8*=0x860, lpOverlapped=0x0) returned 1 [0045.806] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.806] WriteFile (in: hFile=0x230, lpBuffer=0x58db58*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58db58*, lpNumberOfBytesWritten=0x24ad7e4*=0x860, lpOverlapped=0x0) returned 1 [0045.807] GetProcessHeap () returned 0x560000 [0045.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58db58 | out: hHeap=0x560000) returned 1 [0045.807] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.807] WriteFile (in: hFile=0x230, lpBuffer=0x58db20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58db20*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.808] CloseHandle (hObject=0x230) returned 1 [0045.813] GetProcessHeap () returned 0x560000 [0045.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0045.813] GetProcessHeap () returned 0x560000 [0045.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.813] GetProcessHeap () returned 0x560000 [0045.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.814] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" [0045.814] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.badday") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.badday" [0045.814] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.badday" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.badday"), dwFlags=0x1) returned 1 [0045.815] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0045.815] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0045.815] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Desktop\\how_to_back_files.html") returned="C:\\Users\\Public\\Desktop\\how_to_back_files.html" [0045.815] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\how_to_back_files.html" (normalized: "c:\\users\\public\\desktop\\how_to_back_files.html")) returned 0xffffffff [0045.815] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\how_to_back_files.html" (normalized: "c:\\users\\public\\desktop\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.817] GetProcessHeap () returned 0x560000 [0045.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.817] GetProcessHeap () returned 0x560000 [0045.817] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.829] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.835] GetProcessHeap () returned 0x560000 [0045.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.835] GetProcessHeap () returned 0x560000 [0045.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.835] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.836] GetProcessHeap () returned 0x560000 [0045.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.836] GetProcessHeap () returned 0x560000 [0045.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.845] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.846] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.847] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.848] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.848] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.855] GetProcessHeap () returned 0x560000 [0045.855] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.855] GetProcessHeap () returned 0x560000 [0045.855] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.855] CloseHandle (hObject=0x230) returned 1 [0045.860] GetProcessHeap () returned 0x560000 [0045.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a98 | out: hHeap=0x560000) returned 1 [0045.860] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.860] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.860] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.860] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini" [0045.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.860] GetProcessHeap () returned 0x560000 [0045.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.860] lstrlenA (lpString="desktop.ini") returned 11 [0045.860] lstrlenA (lpString=".badday") returned 7 [0045.860] lstrlenA (lpString=".badday") returned 7 [0045.860] lstrlenA (lpString="desktop.ini") returned 11 [0045.860] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.860] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.860] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.860] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.860] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.860] GetProcessHeap () returned 0x560000 [0045.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0045.860] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.861] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=174) returned 1 [0045.861] GetProcessHeap () returned 0x560000 [0045.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.861] GetProcessHeap () returned 0x560000 [0045.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.861] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\desktop.ini") returned 35 [0045.861] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.861] GetProcessHeap () returned 0x560000 [0045.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.861] GetProcessHeap () returned 0x560000 [0045.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x58db58 [0045.861] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.861] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.862] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.862] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.862] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.862] lstrlenA (lpString="010001") returned 6 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3a8 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.862] GetProcessHeap () returned 0x560000 [0045.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b60 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d10 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c678 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d10 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c678 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.863] GetProcessHeap () returned 0x560000 [0045.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0045.863] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.864] GetProcessHeap () returned 0x560000 [0045.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.865] GetProcessHeap () returned 0x560000 [0045.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.865] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.866] GetProcessHeap () returned 0x560000 [0045.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0045.867] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b60 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.868] GetProcessHeap () returned 0x560000 [0045.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.868] WriteFile (in: hFile=0x230, lpBuffer=0x58db58*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58db58*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0045.886] GetProcessHeap () returned 0x560000 [0045.886] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58db58, Size=0x30) returned 0x58db58 [0045.886] GetProcessHeap () returned 0x560000 [0045.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.886] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.886] GetProcessHeap () returned 0x560000 [0045.886] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb0) returned 0x571ec8 [0045.886] ReadFile (in: hFile=0x230, lpBuffer=0x571ec8, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesRead=0x24ad7e8*=0xb0, lpOverlapped=0x0) returned 1 [0045.886] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.886] WriteFile (in: hFile=0x230, lpBuffer=0x571ec8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x571ec8*, lpNumberOfBytesWritten=0x24ad7e4*=0xb0, lpOverlapped=0x0) returned 1 [0045.887] GetProcessHeap () returned 0x560000 [0045.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x571ec8 | out: hHeap=0x560000) returned 1 [0045.888] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.888] WriteFile (in: hFile=0x230, lpBuffer=0x58db58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58db58*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.888] CloseHandle (hObject=0x230) returned 1 [0045.890] GetProcessHeap () returned 0x560000 [0045.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0045.890] GetProcessHeap () returned 0x560000 [0045.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.890] GetProcessHeap () returned 0x560000 [0045.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.890] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Desktop\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini" [0045.890] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini.badday") returned="C:\\Users\\Public\\Desktop\\desktop.ini.badday" [0045.890] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Desktop\\desktop.ini.badday" (normalized: "c:\\users\\public\\desktop\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.890] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0045.890] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0045.891] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Desktop\\how_to_back_files.html") returned="C:\\Users\\Public\\Desktop\\how_to_back_files.html" [0045.891] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\how_to_back_files.html" (normalized: "c:\\users\\public\\desktop\\how_to_back_files.html")) returned 0x20 [0045.891] GetProcessHeap () returned 0x560000 [0045.891] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.891] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0045.891] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0045.891] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0045.891] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" [0045.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0045.891] GetProcessHeap () returned 0x560000 [0045.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576b58 [0045.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Google Chrome.lnk", lpUsedDefaultChar=0x0) returned 18 [0045.891] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0045.891] lstrlenA (lpString=".badday") returned 7 [0045.891] lstrlenA (lpString=".badday") returned 7 [0045.891] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0045.891] lstrcmpiA (lpString1="ome.lnk", lpString2=".badday") returned 1 [0045.891] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="how_to_back_files.html") returned -1 [0045.891] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.891] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.891] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.891] GetProcessHeap () returned 0x560000 [0045.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0045.891] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.891] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2330) returned 1 [0045.892] GetProcessHeap () returned 0x560000 [0045.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.892] GetProcessHeap () returned 0x560000 [0045.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.892] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned 41 [0045.892] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.892] GetProcessHeap () returned 0x560000 [0045.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.892] GetProcessHeap () returned 0x560000 [0045.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x58db90 [0045.892] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.892] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.892] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.892] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.892] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.893] lstrlenA (lpString="010001") returned 6 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be08 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589fd8 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0045.893] GetProcessHeap () returned 0x560000 [0045.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d10 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bf28 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d10 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.894] GetProcessHeap () returned 0x560000 [0045.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.895] GetProcessHeap () returned 0x560000 [0045.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.896] GetProcessHeap () returned 0x560000 [0045.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.897] GetProcessHeap () returned 0x560000 [0045.897] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.897] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.898] GetProcessHeap () returned 0x560000 [0045.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be08 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0045.899] GetProcessHeap () returned 0x560000 [0045.899] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.899] WriteFile (in: hFile=0x230, lpBuffer=0x58db90*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58db90*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0045.944] GetProcessHeap () returned 0x560000 [0045.944] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58db90, Size=0x30) returned 0x58db90 [0045.944] GetProcessHeap () returned 0x560000 [0045.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.944] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.944] GetProcessHeap () returned 0x560000 [0045.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x920) returned 0x58dbc8 [0045.944] ReadFile (in: hFile=0x230, lpBuffer=0x58dbc8, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58dbc8*, lpNumberOfBytesRead=0x24ad7e8*=0x920, lpOverlapped=0x0) returned 1 [0045.944] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.944] WriteFile (in: hFile=0x230, lpBuffer=0x58dbc8*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58dbc8*, lpNumberOfBytesWritten=0x24ad7e4*=0x920, lpOverlapped=0x0) returned 1 [0045.945] GetProcessHeap () returned 0x560000 [0045.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58dbc8 | out: hHeap=0x560000) returned 1 [0045.945] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.945] WriteFile (in: hFile=0x230, lpBuffer=0x58db90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58db90*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.946] CloseHandle (hObject=0x230) returned 1 [0045.947] GetProcessHeap () returned 0x560000 [0045.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0045.947] GetProcessHeap () returned 0x560000 [0045.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.947] GetProcessHeap () returned 0x560000 [0045.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.947] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" [0045.947] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.badday") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.badday" [0045.947] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.badday" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.badday"), dwFlags=0x1) returned 1 [0045.948] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0045.948] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0045.948] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Desktop\\how_to_back_files.html") returned="C:\\Users\\Public\\Desktop\\how_to_back_files.html" [0045.948] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\how_to_back_files.html" (normalized: "c:\\users\\public\\desktop\\how_to_back_files.html")) returned 0x20 [0045.948] GetProcessHeap () returned 0x560000 [0045.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0045.948] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0045.948] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0045.948] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0045.948] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" [0045.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0045.948] GetProcessHeap () returned 0x560000 [0045.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576878 [0045.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mozilla Firefox.lnk", lpUsedDefaultChar=0x0) returned 20 [0045.948] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0045.948] lstrlenA (lpString=".badday") returned 7 [0045.949] lstrlenA (lpString=".badday") returned 7 [0045.949] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0045.949] lstrcmpiA (lpString1="fox.lnk", lpString2=".badday") returned 1 [0045.949] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="how_to_back_files.html") returned 1 [0045.949] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.949] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.949] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0045.949] GetProcessHeap () returned 0x560000 [0045.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d490 [0045.949] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.949] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=999) returned 1 [0045.949] GetProcessHeap () returned 0x560000 [0045.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.949] GetProcessHeap () returned 0x560000 [0045.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.949] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned 43 [0045.949] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.949] GetProcessHeap () returned 0x560000 [0045.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.949] GetProcessHeap () returned 0x560000 [0045.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58dbc8 [0045.949] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.949] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.950] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.950] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.950] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.950] lstrlenA (lpString="010001") returned 6 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589fd8 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4c8 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0045.950] GetProcessHeap () returned 0x560000 [0045.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x589ff8 [0045.950] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cb0 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c168 [0045.951] GetProcessHeap () returned 0x560000 [0045.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cb0 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.952] GetProcessHeap () returned 0x560000 [0045.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.952] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.953] GetProcessHeap () returned 0x560000 [0045.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a178 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a178 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.954] GetProcessHeap () returned 0x560000 [0045.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0045.955] GetProcessHeap () returned 0x560000 [0045.955] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4c8 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.956] GetProcessHeap () returned 0x560000 [0045.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.956] WriteFile (in: hFile=0x230, lpBuffer=0x58dbc8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dbc8*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0045.958] GetProcessHeap () returned 0x560000 [0045.958] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dbc8, Size=0x30) returned 0x58dbc8 [0045.958] GetProcessHeap () returned 0x560000 [0045.958] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.958] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.958] GetProcessHeap () returned 0x560000 [0045.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3f0) returned 0x58dc00 [0045.958] ReadFile (in: hFile=0x230, lpBuffer=0x58dc00, nNumberOfBytesToRead=0x3f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58dc00*, lpNumberOfBytesRead=0x24ad7e8*=0x3f0, lpOverlapped=0x0) returned 1 [0045.958] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.959] WriteFile (in: hFile=0x230, lpBuffer=0x58dc00*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58dc00*, lpNumberOfBytesWritten=0x24ad7e4*=0x3f0, lpOverlapped=0x0) returned 1 [0045.959] GetProcessHeap () returned 0x560000 [0045.959] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58dc00 | out: hHeap=0x560000) returned 1 [0045.959] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.959] WriteFile (in: hFile=0x230, lpBuffer=0x58dbc8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dbc8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.960] CloseHandle (hObject=0x230) returned 1 [0045.961] GetProcessHeap () returned 0x560000 [0045.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d490 | out: hHeap=0x560000) returned 1 [0045.961] GetProcessHeap () returned 0x560000 [0045.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.961] GetProcessHeap () returned 0x560000 [0045.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.961] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" [0045.961] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.badday") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.badday" [0045.962] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.badday" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.badday"), dwFlags=0x1) returned 1 [0045.962] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0045.962] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0045.962] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\Desktop\\how_to_back_files.html") returned="C:\\Users\\Public\\Desktop\\how_to_back_files.html" [0045.962] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\how_to_back_files.html" (normalized: "c:\\users\\public\\desktop\\how_to_back_files.html")) returned 0x20 [0045.962] GetProcessHeap () returned 0x560000 [0045.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0045.962] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0045.962] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0045.962] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0045.962] GetProcessHeap () returned 0x560000 [0045.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585be0 | out: hHeap=0x560000) returned 1 [0045.962] GetProcessHeap () returned 0x560000 [0045.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0045.962] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\") returned 32 [0045.963] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*") returned="C:\\Users\\Public\\AccountPictures\\*" [0045.963] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0045.963] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.963] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.963] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.963] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.963] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.963] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0045.963] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0045.963] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini" [0045.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.963] GetProcessHeap () returned 0x560000 [0045.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0045.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0045.963] lstrlenA (lpString="desktop.ini") returned 11 [0045.963] lstrlenA (lpString=".badday") returned 7 [0045.963] lstrlenA (lpString=".badday") returned 7 [0045.963] lstrlenA (lpString="desktop.ini") returned 11 [0045.963] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0045.963] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0045.963] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0045.963] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0045.963] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0045.963] GetProcessHeap () returned 0x560000 [0045.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0045.963] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0045.964] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=196) returned 1 [0045.964] GetProcessHeap () returned 0x560000 [0045.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.964] GetProcessHeap () returned 0x560000 [0045.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.964] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned 43 [0045.964] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.964] GetProcessHeap () returned 0x560000 [0045.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0045.964] GetProcessHeap () returned 0x560000 [0045.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x58dc00 [0045.964] lstrlenA (lpString="rsa_encrypt") returned 11 [0045.964] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0045.965] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0045.965] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0045.965] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0045.965] lstrlenA (lpString="010001") returned 6 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c288 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0045.965] GetProcessHeap () returned 0x560000 [0045.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ec0 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c828 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c828 | out: hHeap=0x560000) returned 1 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589f08 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c708 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f08 | out: hHeap=0x560000) returned 1 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0045.966] GetProcessHeap () returned 0x560000 [0045.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.968] GetProcessHeap () returned 0x560000 [0045.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0a8 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0a8 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.969] GetProcessHeap () returned 0x560000 [0045.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.969] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589ff8 [0045.970] GetProcessHeap () returned 0x560000 [0045.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ff8 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x589fd8 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589fd8 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.971] GetProcessHeap () returned 0x560000 [0045.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.971] GetProcessHeap () returned 0x560000 [0045.972] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a038 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a038 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ec0 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c288 | out: hHeap=0x560000) returned 1 [0045.972] GetProcessHeap () returned 0x560000 [0045.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0045.973] GetProcessHeap () returned 0x560000 [0045.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0045.973] GetProcessHeap () returned 0x560000 [0045.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0045.973] GetProcessHeap () returned 0x560000 [0045.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0045.973] GetProcessHeap () returned 0x560000 [0045.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0045.973] WriteFile (in: hFile=0x230, lpBuffer=0x58dc00*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dc00*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0045.976] GetProcessHeap () returned 0x560000 [0045.976] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dc00, Size=0x30) returned 0x58dc00 [0045.976] GetProcessHeap () returned 0x560000 [0045.976] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0045.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.977] GetProcessHeap () returned 0x560000 [0045.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd0) returned 0x57aad0 [0045.977] ReadFile (in: hFile=0x230, lpBuffer=0x57aad0, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x57aad0*, lpNumberOfBytesRead=0x24ad7e8*=0xd0, lpOverlapped=0x0) returned 1 [0045.977] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0045.977] WriteFile (in: hFile=0x230, lpBuffer=0x57aad0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x57aad0*, lpNumberOfBytesWritten=0x24ad7e4*=0xd0, lpOverlapped=0x0) returned 1 [0045.978] GetProcessHeap () returned 0x560000 [0045.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57aad0 | out: hHeap=0x560000) returned 1 [0045.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0045.978] WriteFile (in: hFile=0x230, lpBuffer=0x58dc00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dc00*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0045.978] CloseHandle (hObject=0x230) returned 1 [0045.979] GetProcessHeap () returned 0x560000 [0045.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0045.979] GetProcessHeap () returned 0x560000 [0045.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.979] GetProcessHeap () returned 0x560000 [0045.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.979] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\Public\\AccountPictures\\desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini" [0045.980] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini.badday") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini.badday" [0045.980] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini.badday" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0045.980] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\AccountPictures\\desktop.ini" | out: pszPath="C:\\Users\\Public\\AccountPictures") returned 1 [0045.980] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\AccountPictures" | out: pszPath="C:\\Users\\Public\\AccountPictures\\") returned="" [0045.980] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\Public\\AccountPictures\\how_to_back_files.html") returned="C:\\Users\\Public\\AccountPictures\\how_to_back_files.html" [0045.980] GetFileAttributesW (lpFileName="C:\\Users\\Public\\AccountPictures\\how_to_back_files.html" (normalized: "c:\\users\\public\\accountpictures\\how_to_back_files.html")) returned 0xffffffff [0045.980] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\how_to_back_files.html" (normalized: "c:\\users\\public\\accountpictures\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0045.980] GetProcessHeap () returned 0x560000 [0045.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.980] GetProcessHeap () returned 0x560000 [0045.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0045.987] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.988] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.988] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.988] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.988] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.988] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.988] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.999] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.999] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.999] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.999] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0045.999] GetProcessHeap () returned 0x560000 [0045.999] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0045.999] GetProcessHeap () returned 0x560000 [0045.999] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0045.999] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0045.999] GetProcessHeap () returned 0x560000 [0045.999] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0045.999] GetProcessHeap () returned 0x560000 [0045.999] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.024] GetProcessHeap () returned 0x560000 [0046.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.025] GetProcessHeap () returned 0x560000 [0046.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.025] CloseHandle (hObject=0x230) returned 1 [0046.025] GetProcessHeap () returned 0x560000 [0046.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.025] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0046.025] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0046.025] GetProcessHeap () returned 0x560000 [0046.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575a20 | out: hHeap=0x560000) returned 1 [0046.025] GetProcessHeap () returned 0x560000 [0046.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.025] lstrlenW (lpString="C:\\Users\\FD1HVy\\") returned 16 [0046.025] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0046.025] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0046.025] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.025] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.026] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.026] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.026] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0046.026] lstrcmpiW (lpString1="AppData", lpString2=".") returned 1 [0046.026] lstrcmpiW (lpString1="AppData", lpString2="..") returned 1 [0046.026] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="AppData" | out: lpString1="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0046.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.026] GetProcessHeap () returned 0x560000 [0046.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a168 [0046.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=-1, lpMultiByteStr=0x58a168, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 8 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.027] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0046.027] GetProcessHeap () returned 0x560000 [0046.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a178 [0046.027] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\") returned 24 [0046.027] GetProcessHeap () returned 0x560000 [0046.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x32) returned 0x579688 [0046.028] lstrcpyW (in: lpString1=0x579688, lpString2="C:\\Users\\FD1HVy\\AppData\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0046.028] GetProcessHeap () returned 0x560000 [0046.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0046.028] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0046.028] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0046.028] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Application Data" | out: lpString1="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data" [0046.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Application Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.028] GetProcessHeap () returned 0x560000 [0046.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x5769f8 [0046.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Application Data", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application Data", lpUsedDefaultChar=0x0) returned 17 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.030] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0046.030] GetProcessHeap () returned 0x560000 [0046.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a038 [0046.030] lstrlenW (lpString="C:\\Users\\FD1HVy\\Application Data\\") returned 33 [0046.030] GetProcessHeap () returned 0x560000 [0046.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x44) returned 0x5856e0 [0046.030] lstrcpyW (in: lpString1=0x5856e0, lpString2="C:\\Users\\FD1HVy\\Application Data\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0046.030] GetProcessHeap () returned 0x560000 [0046.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0046.030] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0046.030] lstrcmpiW (lpString1="Contacts", lpString2=".") returned 1 [0046.030] lstrcmpiW (lpString1="Contacts", lpString2="..") returned 1 [0046.030] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Contacts" | out: lpString1="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0046.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Contacts", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.030] GetProcessHeap () returned 0x560000 [0046.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0046.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Contacts", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Contacts", lpUsedDefaultChar=0x0) returned 9 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.031] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0046.032] GetProcessHeap () returned 0x560000 [0046.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589ff8 [0046.032] lstrlenW (lpString="C:\\Users\\FD1HVy\\Contacts\\") returned 25 [0046.032] GetProcessHeap () returned 0x560000 [0046.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579748 [0046.032] lstrcpyW (in: lpString1=0x579748, lpString2="C:\\Users\\FD1HVy\\Contacts\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0046.032] GetProcessHeap () returned 0x560000 [0046.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0046.032] lstrcmpiW (lpString1="Cookies", lpString2=".") returned 1 [0046.032] lstrcmpiW (lpString1="Cookies", lpString2="..") returned 1 [0046.032] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Cookies" | out: lpString1="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0046.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.032] GetProcessHeap () returned 0x560000 [0046.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1c8 [0046.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=-1, lpMultiByteStr=0x58a1c8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cookies", lpUsedDefaultChar=0x0) returned 8 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.032] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.033] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0046.033] GetProcessHeap () returned 0x560000 [0046.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0a8 [0046.034] lstrlenW (lpString="C:\\Users\\FD1HVy\\Cookies\\") returned 24 [0046.034] GetProcessHeap () returned 0x560000 [0046.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x32) returned 0x579488 [0046.034] lstrcpyW (in: lpString1=0x579488, lpString2="C:\\Users\\FD1HVy\\Cookies\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0046.034] GetProcessHeap () returned 0x560000 [0046.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.034] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x584b8915, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x584b8915, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0046.034] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0046.034] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0046.034] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Desktop" | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0046.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.034] GetProcessHeap () returned 0x560000 [0046.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a088 [0046.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x58a088, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop", lpUsedDefaultChar=0x0) returned 8 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.035] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.035] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0046.035] GetProcessHeap () returned 0x560000 [0046.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fd8 [0046.035] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\") returned 24 [0046.035] GetProcessHeap () returned 0x560000 [0046.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x32) returned 0x5794c8 [0046.036] lstrcpyW (in: lpString1=0x5794c8, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0046.036] GetProcessHeap () returned 0x560000 [0046.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0046.036] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x539eff8e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x539eff8e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0046.036] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0046.036] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0046.036] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Documents" | out: lpString1="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0046.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.036] GetProcessHeap () returned 0x560000 [0046.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0046.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents", lpUsedDefaultChar=0x0) returned 10 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.036] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.037] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.037] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0046.037] GetProcessHeap () returned 0x560000 [0046.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a088 [0046.037] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\") returned 26 [0046.037] GetProcessHeap () returned 0x560000 [0046.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579608 [0046.037] lstrcpyW (in: lpString1=0x579608, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0046.037] GetProcessHeap () returned 0x560000 [0046.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0046.038] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0046.038] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0046.038] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Downloads" | out: lpString1="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0046.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.038] GetProcessHeap () returned 0x560000 [0046.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0046.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads", lpUsedDefaultChar=0x0) returned 10 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.038] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.039] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.039] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0046.039] GetProcessHeap () returned 0x560000 [0046.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a048 [0046.039] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\") returned 26 [0046.039] GetProcessHeap () returned 0x560000 [0046.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579508 [0046.039] lstrcpyW (in: lpString1=0x579508, lpString2="C:\\Users\\FD1HVy\\Downloads\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0046.039] GetProcessHeap () returned 0x560000 [0046.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.039] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0046.039] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0046.039] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0046.039] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Favorites" | out: lpString1="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0046.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.040] GetProcessHeap () returned 0x560000 [0046.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0046.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites", lpUsedDefaultChar=0x0) returned 10 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.040] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.041] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.041] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0046.041] GetProcessHeap () returned 0x560000 [0046.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a008 [0046.041] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\") returned 26 [0046.041] GetProcessHeap () returned 0x560000 [0046.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579708 [0046.041] lstrcpyW (in: lpString1=0x579708, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0046.041] GetProcessHeap () returned 0x560000 [0046.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0046.041] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0046.041] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0046.041] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0046.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.041] GetProcessHeap () returned 0x560000 [0046.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a058 [0046.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x58a058, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Links", lpUsedDefaultChar=0x0) returned 6 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.042] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.043] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0046.043] GetProcessHeap () returned 0x560000 [0046.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a098 [0046.043] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\") returned 22 [0046.043] GetProcessHeap () returned 0x560000 [0046.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e) returned 0x582a30 [0046.043] lstrcpyW (in: lpString1=0x582a30, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0046.043] GetProcessHeap () returned 0x560000 [0046.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0046.043] lstrcmpiW (lpString1="Local Settings", lpString2=".") returned 1 [0046.043] lstrcmpiW (lpString1="Local Settings", lpString2="..") returned 1 [0046.043] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0046.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local Settings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.043] GetProcessHeap () returned 0x560000 [0046.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0046.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local Settings", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local Settings", lpUsedDefaultChar=0x0) returned 15 [0046.043] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.044] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.045] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.046] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0046.046] GetProcessHeap () returned 0x560000 [0046.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1b8 [0046.046] lstrlenW (lpString="C:\\Users\\FD1HVy\\Local Settings\\") returned 31 [0046.046] GetProcessHeap () returned 0x560000 [0046.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40) returned 0x572d10 [0046.046] lstrcpyW (in: lpString1=0x572d10, lpString2="C:\\Users\\FD1HVy\\Local Settings\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0046.046] GetProcessHeap () returned 0x560000 [0046.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.046] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53a6244c, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53a6244c, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0046.046] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0046.046] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0046.046] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Music" | out: lpString1="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0046.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.046] GetProcessHeap () returned 0x560000 [0046.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a148 [0046.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x58a148, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music", lpUsedDefaultChar=0x0) returned 6 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.046] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.047] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.047] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0046.048] GetProcessHeap () returned 0x560000 [0046.048] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a058 [0046.048] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\") returned 22 [0046.048] GetProcessHeap () returned 0x560000 [0046.048] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e) returned 0x582f38 [0046.048] lstrcpyW (in: lpString1=0x582f38, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0046.048] GetProcessHeap () returned 0x560000 [0046.048] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0046.048] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0046.048] lstrcmpiW (lpString1="My Documents", lpString2=".") returned 1 [0046.048] lstrcmpiW (lpString1="My Documents", lpString2="..") returned 1 [0046.048] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="My Documents" | out: lpString1="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0046.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.048] GetProcessHeap () returned 0x560000 [0046.048] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0046.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Documents", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Documents", lpUsedDefaultChar=0x0) returned 13 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.049] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0046.049] GetProcessHeap () returned 0x560000 [0046.049] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d8 [0046.049] lstrlenW (lpString="C:\\Users\\FD1HVy\\My Documents\\") returned 29 [0046.050] GetProcessHeap () returned 0x560000 [0046.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3c) returned 0x572da0 [0046.050] lstrcpyW (in: lpString1=0x572da0, lpString2="C:\\Users\\FD1HVy\\My Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0046.050] GetProcessHeap () returned 0x560000 [0046.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.050] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0046.050] lstrcmpiW (lpString1="NetHood", lpString2=".") returned 1 [0046.050] lstrcmpiW (lpString1="NetHood", lpString2="..") returned 1 [0046.050] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NetHood" | out: lpString1="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0046.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetHood", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.050] GetProcessHeap () returned 0x560000 [0046.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0046.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetHood", cchWideChar=-1, lpMultiByteStr=0x58a0f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetHood", lpUsedDefaultChar=0x0) returned 8 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.051] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0046.051] GetProcessHeap () returned 0x560000 [0046.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a118 [0046.051] lstrlenW (lpString="C:\\Users\\FD1HVy\\NetHood\\") returned 24 [0046.051] GetProcessHeap () returned 0x560000 [0046.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x32) returned 0x5797c8 [0046.052] lstrcpyW (in: lpString1=0x5797c8, lpString2="C:\\Users\\FD1HVy\\NetHood\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0046.052] GetProcessHeap () returned 0x560000 [0046.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.052] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0046.052] lstrcmpiW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0046.052] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0046.052] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT") returned="C:\\Users\\FD1HVy\\NTUSER.DAT" [0046.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.052] GetProcessHeap () returned 0x560000 [0046.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0046.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT", lpUsedDefaultChar=0x0) returned 11 [0046.052] lstrlenA (lpString="NTUSER.DAT") returned 10 [0046.052] lstrlenA (lpString=".badday") returned 7 [0046.052] lstrlenA (lpString=".badday") returned 7 [0046.052] lstrlenA (lpString="NTUSER.DAT") returned 10 [0046.052] lstrcmpiA (lpString1="SER.DAT", lpString2=".badday") returned 1 [0046.052] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="how_to_back_files.html") returned 1 [0046.052] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.052] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.052] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.052] GetProcessHeap () returned 0x560000 [0046.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0046.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0046.052] CloseHandle (hObject=0xffffffff) returned 1 [0046.053] GetProcessHeap () returned 0x560000 [0046.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0046.053] GetProcessHeap () returned 0x560000 [0046.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.053] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0046.053] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0046.053] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0046.053] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" [0046.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0046.053] GetProcessHeap () returned 0x560000 [0046.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0046.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG1", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.dat.LOG1", lpUsedDefaultChar=0x0) returned 16 [0046.053] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0046.053] lstrlenA (lpString=".badday") returned 7 [0046.053] lstrlenA (lpString=".badday") returned 7 [0046.053] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0046.053] lstrcmpiA (lpString1="at.LOG1", lpString2=".badday") returned 1 [0046.053] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="how_to_back_files.html") returned 1 [0046.053] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.053] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.053] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.053] GetProcessHeap () returned 0x560000 [0046.053] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0046.053] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0046.053] CloseHandle (hObject=0xffffffff) returned 1 [0046.053] GetProcessHeap () returned 0x560000 [0046.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0046.053] GetProcessHeap () returned 0x560000 [0046.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.054] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0046.054] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0046.054] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0046.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" [0046.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0046.054] GetProcessHeap () returned 0x560000 [0046.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0046.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG2", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.dat.LOG2", lpUsedDefaultChar=0x0) returned 16 [0046.054] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0046.054] lstrlenA (lpString=".badday") returned 7 [0046.054] lstrlenA (lpString=".badday") returned 7 [0046.054] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0046.054] lstrcmpiA (lpString1="at.LOG2", lpString2=".badday") returned 1 [0046.054] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="how_to_back_files.html") returned 1 [0046.054] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.054] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.054] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.054] GetProcessHeap () returned 0x560000 [0046.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0046.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0046.054] CloseHandle (hObject=0xffffffff) returned 1 [0046.054] GetProcessHeap () returned 0x560000 [0046.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0046.054] GetProcessHeap () returned 0x560000 [0046.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.054] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0046.054] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2=".") returned 1 [0046.054] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="..") returned 1 [0046.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0046.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0046.055] GetProcessHeap () returned 0x560000 [0046.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38) returned 0x579808 [0046.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cchWideChar=-1, lpMultiByteStr=0x579808, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpUsedDefaultChar=0x0) returned 56 [0046.055] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0046.055] lstrlenA (lpString=".badday") returned 7 [0046.055] lstrlenA (lpString=".badday") returned 7 [0046.055] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0046.055] lstrcmpiA (lpString1=".TM.blf", lpString2=".badday") returned 1 [0046.055] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="how_to_back_files.html") returned 1 [0046.055] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.055] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.055] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.055] GetProcessHeap () returned 0x560000 [0046.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0046.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0046.055] CloseHandle (hObject=0xffffffff) returned 1 [0046.055] GetProcessHeap () returned 0x560000 [0046.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0046.055] GetProcessHeap () returned 0x560000 [0046.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579808 | out: hHeap=0x560000) returned 1 [0046.055] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0046.055] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0046.055] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0046.055] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0046.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0046.056] GetProcessHeap () returned 0x560000 [0046.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5d) returned 0x572a40 [0046.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x572a40, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpUsedDefaultChar=0x0) returned 93 [0046.056] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0046.056] lstrlenA (lpString=".badday") returned 7 [0046.056] lstrlenA (lpString=".badday") returned 7 [0046.056] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0046.056] lstrcmpiA (lpString1="rans-ms", lpString2=".badday") returned 1 [0046.056] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="how_to_back_files.html") returned 1 [0046.056] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.056] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.056] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.056] GetProcessHeap () returned 0x560000 [0046.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0046.056] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0046.056] CloseHandle (hObject=0xffffffff) returned 1 [0046.056] GetProcessHeap () returned 0x560000 [0046.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0046.056] GetProcessHeap () returned 0x560000 [0046.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0046.056] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0046.056] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0046.056] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0046.056] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0046.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0046.056] GetProcessHeap () returned 0x560000 [0046.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5d) returned 0x572a40 [0046.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x572a40, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpUsedDefaultChar=0x0) returned 93 [0046.057] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0046.057] lstrlenA (lpString=".badday") returned 7 [0046.057] lstrlenA (lpString=".badday") returned 7 [0046.057] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0046.057] lstrcmpiA (lpString1="rans-ms", lpString2=".badday") returned 1 [0046.057] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="how_to_back_files.html") returned 1 [0046.057] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.057] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.057] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.057] GetProcessHeap () returned 0x560000 [0046.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0046.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0046.057] CloseHandle (hObject=0xffffffff) returned 1 [0046.057] GetProcessHeap () returned 0x560000 [0046.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0046.057] GetProcessHeap () returned 0x560000 [0046.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0046.057] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0046.057] lstrcmpiW (lpString1="ntuser.ini", lpString2=".") returned 1 [0046.057] lstrcmpiW (lpString1="ntuser.ini", lpString2="..") returned 1 [0046.057] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini" [0046.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.057] GetProcessHeap () returned 0x560000 [0046.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0046.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.ini", lpUsedDefaultChar=0x0) returned 11 [0046.057] lstrlenA (lpString="ntuser.ini") returned 10 [0046.057] lstrlenA (lpString=".badday") returned 7 [0046.057] lstrlenA (lpString=".badday") returned 7 [0046.057] lstrlenA (lpString="ntuser.ini") returned 10 [0046.058] lstrcmpiA (lpString1="ser.ini", lpString2=".badday") returned 1 [0046.058] lstrcmpiW (lpString1="ntuser.ini", lpString2="how_to_back_files.html") returned 1 [0046.058] lstrcmpiW (lpString1="ntuser.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.058] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.058] lstrcmpiW (lpString1="ntuser.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.058] GetProcessHeap () returned 0x560000 [0046.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0046.058] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.058] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=20) returned 1 [0046.058] GetProcessHeap () returned 0x560000 [0046.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.058] GetProcessHeap () returned 0x560000 [0046.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.058] lstrlenW (lpString="C:\\Users\\FD1HVy\\ntuser.ini") returned 26 [0046.058] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.058] GetProcessHeap () returned 0x560000 [0046.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.058] GetProcessHeap () returned 0x560000 [0046.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x58dc38 [0046.058] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.058] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.059] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.059] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.059] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.059] lstrlenA (lpString="010001") returned 6 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3a8 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be08 [0046.059] GetProcessHeap () returned 0x560000 [0046.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d58 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bb38 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.060] GetProcessHeap () returned 0x560000 [0046.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d40 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c0d8 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d40 | out: hHeap=0x560000) returned 1 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0046.075] GetProcessHeap () returned 0x560000 [0046.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.076] GetProcessHeap () returned 0x560000 [0046.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.076] GetProcessHeap () returned 0x560000 [0046.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.076] GetProcessHeap () returned 0x560000 [0046.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.076] GetProcessHeap () returned 0x560000 [0046.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.077] GetProcessHeap () returned 0x560000 [0046.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.078] GetProcessHeap () returned 0x560000 [0046.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.079] GetProcessHeap () returned 0x560000 [0046.079] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.079] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.080] GetProcessHeap () returned 0x560000 [0046.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.080] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0046.081] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d58 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be08 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0046.082] GetProcessHeap () returned 0x560000 [0046.082] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.082] WriteFile (in: hFile=0x230, lpBuffer=0x58dc38*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dc38*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0046.086] GetProcessHeap () returned 0x560000 [0046.086] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dc38, Size=0x30) returned 0x58dc38 [0046.086] GetProcessHeap () returned 0x560000 [0046.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.086] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.086] GetProcessHeap () returned 0x560000 [0046.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x20) returned 0x57d350 [0046.086] ReadFile (in: hFile=0x230, lpBuffer=0x57d350, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x57d350*, lpNumberOfBytesRead=0x24ad7e8*=0x20, lpOverlapped=0x0) returned 1 [0046.086] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.086] WriteFile (in: hFile=0x230, lpBuffer=0x57d350*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x57d350*, lpNumberOfBytesWritten=0x24ad7e4*=0x20, lpOverlapped=0x0) returned 1 [0046.087] GetProcessHeap () returned 0x560000 [0046.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0046.087] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.087] WriteFile (in: hFile=0x230, lpBuffer=0x58dc38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dc38*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.088] CloseHandle (hObject=0x230) returned 1 [0046.089] GetProcessHeap () returned 0x560000 [0046.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0046.089] GetProcessHeap () returned 0x560000 [0046.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.089] GetProcessHeap () returned 0x560000 [0046.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.089] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini" [0046.089] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\ntuser.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini.badday") returned="C:\\Users\\FD1HVy\\ntuser.ini.badday" [0046.089] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="C:\\Users\\FD1HVy\\ntuser.ini.badday" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.badday"), dwFlags=0x1) returned 1 [0046.090] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\ntuser.ini" | out: pszPath="C:\\Users\\FD1HVy") returned 1 [0046.090] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy" | out: pszPath="C:\\Users\\FD1HVy\\") returned="" [0046.090] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\how_to_back_files.html" [0046.090] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\how_to_back_files.html")) returned 0xffffffff [0046.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0046.090] GetProcessHeap () returned 0x560000 [0046.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.090] GetProcessHeap () returned 0x560000 [0046.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.097] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.099] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.100] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.100] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.117] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.119] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.120] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.122] GetProcessHeap () returned 0x560000 [0046.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.122] GetProcessHeap () returned 0x560000 [0046.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.122] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0046.123] GetProcessHeap () returned 0x560000 [0046.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.123] GetProcessHeap () returned 0x560000 [0046.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.130] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.131] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.132] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.133] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.134] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.135] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.135] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.135] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.154] GetProcessHeap () returned 0x560000 [0046.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.154] GetProcessHeap () returned 0x560000 [0046.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.154] CloseHandle (hObject=0x230) returned 1 [0046.155] GetProcessHeap () returned 0x560000 [0046.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.155] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0046.155] lstrcmpiW (lpString1="OneDrive", lpString2=".") returned 1 [0046.155] lstrcmpiW (lpString1="OneDrive", lpString2="..") returned 1 [0046.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0046.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.155] GetProcessHeap () returned 0x560000 [0046.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0046.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneDrive", lpUsedDefaultChar=0x0) returned 9 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.155] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.156] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.157] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0046.157] GetProcessHeap () returned 0x560000 [0046.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0046.157] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\") returned 25 [0046.157] GetProcessHeap () returned 0x560000 [0046.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579808 [0046.157] lstrcpyW (in: lpString1=0x579808, lpString2="C:\\Users\\FD1HVy\\OneDrive\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0046.157] GetProcessHeap () returned 0x560000 [0046.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.157] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53c78550, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53c78550, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0046.157] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0046.157] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0046.157] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0046.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.157] GetProcessHeap () returned 0x560000 [0046.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0046.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pictures", lpUsedDefaultChar=0x0) returned 9 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.157] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.158] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.159] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0046.159] GetProcessHeap () returned 0x560000 [0046.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a138 [0046.159] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\") returned 25 [0046.159] GetProcessHeap () returned 0x560000 [0046.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x579848 [0046.159] lstrcpyW (in: lpString1=0x579848, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0046.159] GetProcessHeap () returned 0x560000 [0046.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.159] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0046.159] lstrcmpiW (lpString1="PrintHood", lpString2=".") returned 1 [0046.159] lstrcmpiW (lpString1="PrintHood", lpString2="..") returned 1 [0046.159] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0046.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PrintHood", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.159] GetProcessHeap () returned 0x560000 [0046.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0046.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PrintHood", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrintHood", lpUsedDefaultChar=0x0) returned 10 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.159] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.160] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0046.161] GetProcessHeap () returned 0x560000 [0046.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1c8 [0046.161] lstrlenW (lpString="C:\\Users\\FD1HVy\\PrintHood\\") returned 26 [0046.161] GetProcessHeap () returned 0x560000 [0046.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x579888 [0046.161] lstrcpyW (in: lpString1=0x579888, lpString2="C:\\Users\\FD1HVy\\PrintHood\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0046.161] GetProcessHeap () returned 0x560000 [0046.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.161] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0046.161] lstrcmpiW (lpString1="Recent", lpString2=".") returned 1 [0046.161] lstrcmpiW (lpString1="Recent", lpString2="..") returned 1 [0046.161] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Recent" | out: lpString1="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0046.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recent", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.161] GetProcessHeap () returned 0x560000 [0046.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a148 [0046.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recent", cchWideChar=-1, lpMultiByteStr=0x58a148, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recent", lpUsedDefaultChar=0x0) returned 7 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.162] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0046.162] GetProcessHeap () returned 0x560000 [0046.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a198 [0046.163] lstrlenW (lpString="C:\\Users\\FD1HVy\\Recent\\") returned 23 [0046.163] GetProcessHeap () returned 0x560000 [0046.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x30) returned 0x582d40 [0046.163] lstrcpyW (in: lpString1=0x582d40, lpString2="C:\\Users\\FD1HVy\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0046.163] GetProcessHeap () returned 0x560000 [0046.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0046.163] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0046.163] lstrcmpiW (lpString1="Saved Games", lpString2=".") returned 1 [0046.163] lstrcmpiW (lpString1="Saved Games", lpString2="..") returned 1 [0046.163] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0046.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Games", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.163] GetProcessHeap () returned 0x560000 [0046.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0046.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Games", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saved Games", lpUsedDefaultChar=0x0) returned 12 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.164] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.164] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0046.164] GetProcessHeap () returned 0x560000 [0046.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a148 [0046.164] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\") returned 28 [0046.164] GetProcessHeap () returned 0x560000 [0046.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3a) returned 0x572f08 [0046.165] lstrcpyW (in: lpString1=0x572f08, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0046.165] GetProcessHeap () returned 0x560000 [0046.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.165] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0046.165] lstrcmpiW (lpString1="Searches", lpString2=".") returned 1 [0046.165] lstrcmpiW (lpString1="Searches", lpString2="..") returned 1 [0046.165] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Searches" | out: lpString1="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0046.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Searches", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.165] GetProcessHeap () returned 0x560000 [0046.165] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0046.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Searches", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Searches", lpUsedDefaultChar=0x0) returned 9 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.166] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0046.166] GetProcessHeap () returned 0x560000 [0046.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a158 [0046.166] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\") returned 25 [0046.166] GetProcessHeap () returned 0x560000 [0046.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x58cfc8 [0046.166] lstrcpyW (in: lpString1=0x58cfc8, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0046.166] GetProcessHeap () returned 0x560000 [0046.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.167] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0046.167] lstrcmpiW (lpString1="SendTo", lpString2=".") returned 1 [0046.167] lstrcmpiW (lpString1="SendTo", lpString2="..") returned 1 [0046.167] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="SendTo" | out: lpString1="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0046.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendTo", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.167] GetProcessHeap () returned 0x560000 [0046.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a168 [0046.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendTo", cchWideChar=-1, lpMultiByteStr=0x58a168, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendTo", lpUsedDefaultChar=0x0) returned 7 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.167] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.168] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.168] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0046.168] GetProcessHeap () returned 0x560000 [0046.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a398 [0046.168] lstrlenW (lpString="C:\\Users\\FD1HVy\\SendTo\\") returned 23 [0046.168] GetProcessHeap () returned 0x560000 [0046.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x30) returned 0x582cd0 [0046.168] lstrcpyW (in: lpString1=0x582cd0, lpString2="C:\\Users\\FD1HVy\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0046.168] GetProcessHeap () returned 0x560000 [0046.168] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0046.168] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0046.169] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0046.169] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0046.169] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0046.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Start Menu", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.169] GetProcessHeap () returned 0x560000 [0046.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0046.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Start Menu", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Start Menu", lpUsedDefaultChar=0x0) returned 11 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.169] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.172] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0046.173] GetProcessHeap () returned 0x560000 [0046.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a168 [0046.173] lstrlenW (lpString="C:\\Users\\FD1HVy\\Start Menu\\") returned 27 [0046.173] GetProcessHeap () returned 0x560000 [0046.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38) returned 0x58d008 [0046.173] lstrcpyW (in: lpString1=0x58d008, lpString2="C:\\Users\\FD1HVy\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0046.173] GetProcessHeap () returned 0x560000 [0046.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.173] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0046.173] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0046.173] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0046.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Templates" | out: lpString1="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0046.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.173] GetProcessHeap () returned 0x560000 [0046.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0046.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Templates", lpUsedDefaultChar=0x0) returned 10 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.173] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.174] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.175] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0046.175] GetProcessHeap () returned 0x560000 [0046.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1f8 [0046.175] lstrlenW (lpString="C:\\Users\\FD1HVy\\Templates\\") returned 26 [0046.175] GetProcessHeap () returned 0x560000 [0046.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x36) returned 0x58cf48 [0046.175] lstrcpyW (in: lpString1=0x58cf48, lpString2="C:\\Users\\FD1HVy\\Templates\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0046.175] GetProcessHeap () returned 0x560000 [0046.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.175] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53b93a3a, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53b93a3a, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0046.175] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0046.175] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0046.175] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Videos" | out: lpString1="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0046.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.175] GetProcessHeap () returned 0x560000 [0046.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a2c8 [0046.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x58a2c8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Videos", lpUsedDefaultChar=0x0) returned 7 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.175] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.176] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.176] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0046.177] GetProcessHeap () returned 0x560000 [0046.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a288 [0046.177] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\") returned 23 [0046.177] GetProcessHeap () returned 0x560000 [0046.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x30) returned 0x582b10 [0046.177] lstrcpyW (in: lpString1=0x582b10, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0046.177] GetProcessHeap () returned 0x560000 [0046.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.177] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53b93a3a, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53b93a3a, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0046.177] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0046.177] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0046.177] GetProcessHeap () returned 0x560000 [0046.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582b10 | out: hHeap=0x560000) returned 1 [0046.177] GetProcessHeap () returned 0x560000 [0046.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.177] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\") returned 23 [0046.177] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\*") returned="C:\\Users\\FD1HVy\\Videos\\*" [0046.177] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53b93a3a, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53b93a3a, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58d148 [0046.177] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.177] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53b93a3a, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53b93a3a, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.177] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.177] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.177] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc153e500, ftCreationTime.dwHighDateTime=0x1d4d1df, ftLastAccessTime.dwLowDateTime=0x368c690, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x368c690, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0x13f1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-jznahtE4kKp77.swf", cAlternateFileName="-JZNAH~1.SWF")) returned 1 [0046.177] lstrcmpiW (lpString1="-jznahtE4kKp77.swf", lpString2=".") returned 1 [0046.178] lstrcmpiW (lpString1="-jznahtE4kKp77.swf", lpString2="..") returned 1 [0046.178] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="-jznahtE4kKp77.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf") returned="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf" [0046.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-jznahtE4kKp77.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0046.178] GetProcessHeap () returned 0x560000 [0046.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0046.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-jznahtE4kKp77.swf", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-jznahtE4kKp77.swf", lpUsedDefaultChar=0x0) returned 19 [0046.178] lstrlenA (lpString="-jznahtE4kKp77.swf") returned 18 [0046.178] lstrlenA (lpString=".badday") returned 7 [0046.178] lstrlenA (lpString=".badday") returned 7 [0046.178] lstrlenA (lpString="-jznahtE4kKp77.swf") returned 18 [0046.178] lstrcmpiA (lpString1="p77.swf", lpString2=".badday") returned 1 [0046.178] lstrcmpiW (lpString1="-jznahtE4kKp77.swf", lpString2="how_to_back_files.html") returned 1 [0046.178] lstrcmpiW (lpString1="-jznahtE4kKp77.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.178] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.178] lstrcmpiW (lpString1="-jznahtE4kKp77.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.178] GetProcessHeap () returned 0x560000 [0046.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0046.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf" (normalized: "c:\\users\\fd1hvy\\videos\\-jznahte4kkp77.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.178] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=5105) returned 1 [0046.178] GetProcessHeap () returned 0x560000 [0046.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.178] GetProcessHeap () returned 0x560000 [0046.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.178] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf") returned 41 [0046.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.178] GetProcessHeap () returned 0x560000 [0046.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.179] GetProcessHeap () returned 0x560000 [0046.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x58dc70 [0046.179] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.179] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.179] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.179] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.179] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.179] GetProcessHeap () returned 0x560000 [0046.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.179] lstrlenA (lpString="010001") returned 6 [0046.179] GetProcessHeap () returned 0x560000 [0046.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2c8 [0046.179] GetProcessHeap () returned 0x560000 [0046.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.179] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bb38 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2b8 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.180] GetProcessHeap () returned 0x560000 [0046.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b90 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c948 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b90 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.181] GetProcessHeap () returned 0x560000 [0046.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.181] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.182] GetProcessHeap () returned 0x560000 [0046.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.182] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.183] GetProcessHeap () returned 0x560000 [0046.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.184] GetProcessHeap () returned 0x560000 [0046.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.185] GetProcessHeap () returned 0x560000 [0046.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.207] GetProcessHeap () returned 0x560000 [0046.208] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.208] GetProcessHeap () returned 0x560000 [0046.208] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.208] WriteFile (in: hFile=0x230, lpBuffer=0x58dc70*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dc70*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0046.210] GetProcessHeap () returned 0x560000 [0046.210] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dc70, Size=0x30) returned 0x58dc70 [0046.210] GetProcessHeap () returned 0x560000 [0046.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.210] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.210] GetProcessHeap () returned 0x560000 [0046.210] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1400) returned 0x5a13b8 [0046.210] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x1400, lpOverlapped=0x0) returned 1 [0046.211] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.211] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x1400, lpOverlapped=0x0) returned 1 [0046.212] GetProcessHeap () returned 0x560000 [0046.212] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.212] WriteFile (in: hFile=0x230, lpBuffer=0x58dc70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dc70*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.213] CloseHandle (hObject=0x230) returned 1 [0046.214] GetProcessHeap () returned 0x560000 [0046.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0046.214] GetProcessHeap () returned 0x560000 [0046.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.214] GetProcessHeap () returned 0x560000 [0046.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.214] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf") returned="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf" [0046.214] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf.badday" [0046.214] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf" (normalized: "c:\\users\\fd1hvy\\videos\\-jznahte4kkp77.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\-jznahte4kkp77.swf.badday"), dwFlags=0x1) returned 1 [0046.215] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\-jznahtE4kKp77.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0046.215] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0046.215] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" [0046.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_to_back_files.html")) returned 0xffffffff [0046.215] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0046.215] GetProcessHeap () returned 0x560000 [0046.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.215] GetProcessHeap () returned 0x560000 [0046.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.222] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.223] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.223] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.223] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.224] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.226] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.229] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.231] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.234] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.234] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.234] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.236] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.236] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.236] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.236] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.236] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.236] GetProcessHeap () returned 0x560000 [0046.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.236] GetProcessHeap () returned 0x560000 [0046.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.236] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0046.236] GetProcessHeap () returned 0x560000 [0046.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.236] GetProcessHeap () returned 0x560000 [0046.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.328] GetProcessHeap () returned 0x560000 [0046.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.329] GetProcessHeap () returned 0x560000 [0046.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.329] CloseHandle (hObject=0x230) returned 1 [0046.329] GetProcessHeap () returned 0x560000 [0046.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0046.329] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83170100, ftCreationTime.dwHighDateTime=0x1d4cb1d, ftLastAccessTime.dwLowDateTime=0x29feb10, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0x29feb10, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5CXoE8Jcrysc", cAlternateFileName="5CXOE8~1")) returned 1 [0046.329] lstrcmpiW (lpString1="5CXoE8Jcrysc", lpString2=".") returned 1 [0046.329] lstrcmpiW (lpString1="5CXoE8Jcrysc", lpString2="..") returned 1 [0046.329] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="5CXoE8Jcrysc" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc" [0046.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5CXoE8Jcrysc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.329] GetProcessHeap () returned 0x560000 [0046.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0046.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5CXoE8Jcrysc", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5CXoE8Jcrysc", lpUsedDefaultChar=0x0) returned 13 [0046.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="5CXoE8Jcrysc", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.331] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\" [0046.331] GetProcessHeap () returned 0x560000 [0046.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a318 [0046.331] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned 36 [0046.331] GetProcessHeap () returned 0x560000 [0046.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4a) returned 0x59ec60 [0046.331] lstrcpyW (in: lpString1=0x59ec60, lpString2="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\" [0046.331] GetProcessHeap () returned 0x560000 [0046.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.331] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c9acb80, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x689807b0, ftLastAccessTime.dwHighDateTime=0x1d4cd62, ftLastWriteTime.dwLowDateTime=0x689807b0, ftLastWriteTime.dwHighDateTime=0x1d4cd62, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6e8O", cAlternateFileName="")) returned 1 [0046.331] lstrcmpiW (lpString1="6e8O", lpString2=".") returned 1 [0046.331] lstrcmpiW (lpString1="6e8O", lpString2="..") returned 1 [0046.331] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="6e8O" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O") returned="C:\\Users\\FD1HVy\\Videos\\6e8O" [0046.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6e8O", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.332] GetProcessHeap () returned 0x560000 [0046.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a238 [0046.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6e8O", cchWideChar=-1, lpMultiByteStr=0x58a238, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6e8O", lpUsedDefaultChar=0x0) returned 5 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6e8O", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\" [0046.333] GetProcessHeap () returned 0x560000 [0046.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a2c8 [0046.333] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned 28 [0046.333] GetProcessHeap () returned 0x560000 [0046.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3a) returned 0x572c80 [0046.333] lstrcpyW (in: lpString1=0x572c80, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\" [0046.333] GetProcessHeap () returned 0x560000 [0046.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.333] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.333] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0046.333] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0046.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini" [0046.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.334] GetProcessHeap () returned 0x560000 [0046.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0046.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0046.334] lstrlenA (lpString="desktop.ini") returned 11 [0046.334] lstrlenA (lpString=".badday") returned 7 [0046.334] lstrlenA (lpString=".badday") returned 7 [0046.334] lstrlenA (lpString="desktop.ini") returned 11 [0046.334] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0046.334] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0046.334] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.334] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.334] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.334] GetProcessHeap () returned 0x560000 [0046.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0046.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.334] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=504) returned 1 [0046.334] GetProcessHeap () returned 0x560000 [0046.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.334] GetProcessHeap () returned 0x560000 [0046.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.334] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned 34 [0046.334] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.334] GetProcessHeap () returned 0x560000 [0046.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.335] GetProcessHeap () returned 0x560000 [0046.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58dca8 [0046.335] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.335] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.335] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.335] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.335] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.335] GetProcessHeap () returned 0x560000 [0046.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.335] lstrlenA (lpString="010001") returned 6 [0046.335] GetProcessHeap () returned 0x560000 [0046.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2f8 [0046.335] GetProcessHeap () returned 0x560000 [0046.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.335] GetProcessHeap () returned 0x560000 [0046.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c0d8 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a368 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca68 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c38 [0046.336] GetProcessHeap () returned 0x560000 [0046.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c798 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c38 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c798 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.337] GetProcessHeap () returned 0x560000 [0046.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.338] GetProcessHeap () returned 0x560000 [0046.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.339] GetProcessHeap () returned 0x560000 [0046.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.340] GetProcessHeap () returned 0x560000 [0046.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0046.341] GetProcessHeap () returned 0x560000 [0046.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.342] GetProcessHeap () returned 0x560000 [0046.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.342] WriteFile (in: hFile=0x230, lpBuffer=0x58dca8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dca8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0046.345] GetProcessHeap () returned 0x560000 [0046.345] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dca8, Size=0x30) returned 0x58dca8 [0046.345] GetProcessHeap () returned 0x560000 [0046.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.345] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.345] GetProcessHeap () returned 0x560000 [0046.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.345] ReadFile (in: hFile=0x230, lpBuffer=0x58a3b0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesRead=0x24ad7e8*=0x200, lpOverlapped=0x0) returned 1 [0046.345] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.345] WriteFile (in: hFile=0x230, lpBuffer=0x58a3b0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x200, lpOverlapped=0x0) returned 1 [0046.346] GetProcessHeap () returned 0x560000 [0046.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.347] WriteFile (in: hFile=0x230, lpBuffer=0x58dca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dca8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.348] CloseHandle (hObject=0x230) returned 1 [0046.349] GetProcessHeap () returned 0x560000 [0046.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0046.349] GetProcessHeap () returned 0x560000 [0046.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.349] GetProcessHeap () returned 0x560000 [0046.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.350] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini" [0046.350] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini.badday" [0046.350] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0046.350] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0046.350] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0046.350] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" [0046.350] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_to_back_files.html")) returned 0x20 [0046.350] GetProcessHeap () returned 0x560000 [0046.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.350] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60204f50, ftCreationTime.dwHighDateTime=0x1d4c7e7, ftLastAccessTime.dwLowDateTime=0xd97fa780, ftLastAccessTime.dwHighDateTime=0x1d4ccd1, ftLastWriteTime.dwLowDateTime=0xd97fa780, ftLastWriteTime.dwHighDateTime=0x1d4ccd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dqz_0X9ePbor5mqd U_X", cAlternateFileName="DQZ_0X~1")) returned 1 [0046.350] lstrcmpiW (lpString1="Dqz_0X9ePbor5mqd U_X", lpString2=".") returned 1 [0046.350] lstrcmpiW (lpString1="Dqz_0X9ePbor5mqd U_X", lpString2="..") returned 1 [0046.350] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Dqz_0X9ePbor5mqd U_X" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X" [0046.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dqz_0X9ePbor5mqd U_X", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0046.351] GetProcessHeap () returned 0x560000 [0046.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576a58 [0046.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dqz_0X9ePbor5mqd U_X", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dqz_0X9ePbor5mqd U_X", lpUsedDefaultChar=0x0) returned 21 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.351] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.352] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Dqz_0X9ePbor5mqd U_X", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.352] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\" [0046.352] GetProcessHeap () returned 0x560000 [0046.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a2e8 [0046.352] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned 44 [0046.352] GetProcessHeap () returned 0x560000 [0046.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5a) returned 0x572a40 [0046.352] lstrcpyW (in: lpString1=0x572a40, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\" [0046.352] GetProcessHeap () returned 0x560000 [0046.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0046.352] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34f914a0, ftCreationTime.dwHighDateTime=0x1d4c77f, ftLastAccessTime.dwLowDateTime=0x9dfb54c0, ftLastAccessTime.dwHighDateTime=0x1d4ce1b, ftLastWriteTime.dwLowDateTime=0x9dfb54c0, ftLastWriteTime.dwHighDateTime=0x1d4ce1b, nFileSizeHigh=0x0, nFileSizeLow=0x481f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HP3DxWFdt.flv", cAlternateFileName="HP3DXW~1.FLV")) returned 1 [0046.352] lstrcmpiW (lpString1="HP3DxWFdt.flv", lpString2=".") returned 1 [0046.352] lstrcmpiW (lpString1="HP3DxWFdt.flv", lpString2="..") returned 1 [0046.352] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HP3DxWFdt.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv") returned="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv" [0046.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HP3DxWFdt.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0046.353] GetProcessHeap () returned 0x560000 [0046.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0046.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HP3DxWFdt.flv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HP3DxWFdt.flv", lpUsedDefaultChar=0x0) returned 14 [0046.353] lstrlenA (lpString="HP3DxWFdt.flv") returned 13 [0046.353] lstrlenA (lpString=".badday") returned 7 [0046.353] lstrlenA (lpString=".badday") returned 7 [0046.353] lstrlenA (lpString="HP3DxWFdt.flv") returned 13 [0046.353] lstrcmpiA (lpString1="Fdt.flv", lpString2=".badday") returned 1 [0046.353] lstrcmpiW (lpString1="HP3DxWFdt.flv", lpString2="how_to_back_files.html") returned 1 [0046.353] lstrcmpiW (lpString1="HP3DxWFdt.flv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.353] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.353] lstrcmpiW (lpString1="HP3DxWFdt.flv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.353] GetProcessHeap () returned 0x560000 [0046.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0046.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv" (normalized: "c:\\users\\fd1hvy\\videos\\hp3dxwfdt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.353] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=18463) returned 1 [0046.353] GetProcessHeap () returned 0x560000 [0046.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.353] GetProcessHeap () returned 0x560000 [0046.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.353] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv") returned 36 [0046.353] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.353] GetProcessHeap () returned 0x560000 [0046.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.353] GetProcessHeap () returned 0x560000 [0046.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x58dce0 [0046.353] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.354] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.354] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.354] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.354] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.354] GetProcessHeap () returned 0x560000 [0046.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.354] lstrlenA (lpString="010001") returned 6 [0046.354] GetProcessHeap () returned 0x560000 [0046.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0046.354] GetProcessHeap () returned 0x560000 [0046.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.354] GetProcessHeap () returned 0x560000 [0046.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c318 [0046.354] GetProcessHeap () returned 0x560000 [0046.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3a8 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a278 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e90 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ec0 [0046.355] GetProcessHeap () returned 0x560000 [0046.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.355] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c1f8 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ec0 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1f8 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.356] GetProcessHeap () returned 0x560000 [0046.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.356] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.357] GetProcessHeap () returned 0x560000 [0046.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.357] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.358] GetProcessHeap () returned 0x560000 [0046.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.358] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.359] GetProcessHeap () returned 0x560000 [0046.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e90 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0046.360] GetProcessHeap () returned 0x560000 [0046.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.361] GetProcessHeap () returned 0x560000 [0046.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0046.361] GetProcessHeap () returned 0x560000 [0046.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.361] GetProcessHeap () returned 0x560000 [0046.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.361] GetProcessHeap () returned 0x560000 [0046.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.361] WriteFile (in: hFile=0x230, lpBuffer=0x58dce0*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dce0*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0046.366] GetProcessHeap () returned 0x560000 [0046.366] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dce0, Size=0x30) returned 0x58dce0 [0046.366] GetProcessHeap () returned 0x560000 [0046.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.366] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.366] GetProcessHeap () returned 0x560000 [0046.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4820) returned 0x5a13b8 [0046.366] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x4820, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x4820, lpOverlapped=0x0) returned 1 [0046.366] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.366] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x4820, lpOverlapped=0x0) returned 1 [0046.367] GetProcessHeap () returned 0x560000 [0046.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.368] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.369] WriteFile (in: hFile=0x230, lpBuffer=0x58dce0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dce0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.369] CloseHandle (hObject=0x230) returned 1 [0046.371] GetProcessHeap () returned 0x560000 [0046.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0046.371] GetProcessHeap () returned 0x560000 [0046.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.371] GetProcessHeap () returned 0x560000 [0046.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.371] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv") returned="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv" [0046.371] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv.badday") returned="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv.badday" [0046.371] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv" (normalized: "c:\\users\\fd1hvy\\videos\\hp3dxwfdt.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\hp3dxwfdt.flv.badday"), dwFlags=0x1) returned 1 [0046.372] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\HP3DxWFdt.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0046.372] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0046.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" [0046.372] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_to_back_files.html")) returned 0x20 [0046.372] GetProcessHeap () returned 0x560000 [0046.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.372] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcecbb6b0, ftCreationTime.dwHighDateTime=0x1d4cd28, ftLastAccessTime.dwLowDateTime=0x1aed88d0, ftLastAccessTime.dwHighDateTime=0x1d4c85f, ftLastWriteTime.dwLowDateTime=0x1aed88d0, ftLastWriteTime.dwHighDateTime=0x1d4c85f, nFileSizeHigh=0x0, nFileSizeLow=0xbcd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SxDnaZ.mp4", cAlternateFileName="")) returned 1 [0046.372] lstrcmpiW (lpString1="SxDnaZ.mp4", lpString2=".") returned 1 [0046.372] lstrcmpiW (lpString1="SxDnaZ.mp4", lpString2="..") returned 1 [0046.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="SxDnaZ.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4" [0046.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SxDnaZ.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.372] GetProcessHeap () returned 0x560000 [0046.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0046.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SxDnaZ.mp4", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SxDnaZ.mp4", lpUsedDefaultChar=0x0) returned 11 [0046.372] lstrlenA (lpString="SxDnaZ.mp4") returned 10 [0046.372] lstrlenA (lpString=".badday") returned 7 [0046.372] lstrlenA (lpString=".badday") returned 7 [0046.372] lstrlenA (lpString="SxDnaZ.mp4") returned 10 [0046.372] lstrcmpiA (lpString1="naZ.mp4", lpString2=".badday") returned 1 [0046.372] lstrcmpiW (lpString1="SxDnaZ.mp4", lpString2="how_to_back_files.html") returned 1 [0046.372] lstrcmpiW (lpString1="SxDnaZ.mp4", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.372] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.372] lstrcmpiW (lpString1="SxDnaZ.mp4", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.372] GetProcessHeap () returned 0x560000 [0046.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0046.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sxdnaz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.373] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=48344) returned 1 [0046.373] GetProcessHeap () returned 0x560000 [0046.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.373] GetProcessHeap () returned 0x560000 [0046.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.373] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4") returned 33 [0046.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.373] GetProcessHeap () returned 0x560000 [0046.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.373] GetProcessHeap () returned 0x560000 [0046.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58dd18 [0046.373] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.373] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.374] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.374] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.374] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.374] lstrlenA (lpString="010001") returned 6 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a358 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c9d8 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a238 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.374] GetProcessHeap () returned 0x560000 [0046.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0046.374] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ce0 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be08 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be08 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bce8 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.375] GetProcessHeap () returned 0x560000 [0046.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.375] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.376] GetProcessHeap () returned 0x560000 [0046.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.377] GetProcessHeap () returned 0x560000 [0046.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.378] GetProcessHeap () returned 0x560000 [0046.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.378] GetProcessHeap () returned 0x560000 [0046.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.380] GetProcessHeap () returned 0x560000 [0046.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.380] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.381] GetProcessHeap () returned 0x560000 [0046.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ce0 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.382] GetProcessHeap () returned 0x560000 [0046.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.382] WriteFile (in: hFile=0x230, lpBuffer=0x58dd18*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dd18*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.384] GetProcessHeap () returned 0x560000 [0046.384] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dd18, Size=0x30) returned 0x58dd18 [0046.384] GetProcessHeap () returned 0x560000 [0046.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.384] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.384] GetProcessHeap () returned 0x560000 [0046.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xbcd8) returned 0x5a13b8 [0046.386] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0xbcd8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0xbcd8, lpOverlapped=0x0) returned 1 [0046.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.387] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0xbcd8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xbcd8, lpOverlapped=0x0) returned 1 [0046.388] GetProcessHeap () returned 0x560000 [0046.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.388] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.388] WriteFile (in: hFile=0x230, lpBuffer=0x58dd18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dd18*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.389] CloseHandle (hObject=0x230) returned 1 [0046.391] GetProcessHeap () returned 0x560000 [0046.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0046.391] GetProcessHeap () returned 0x560000 [0046.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.391] GetProcessHeap () returned 0x560000 [0046.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.391] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4" [0046.391] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4.badday") returned="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4.badday" [0046.391] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sxdnaz.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4.badday" (normalized: "c:\\users\\fd1hvy\\videos\\sxdnaz.mp4.badday"), dwFlags=0x1) returned 1 [0046.392] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\SxDnaZ.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0046.392] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0046.392] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" [0046.392] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_to_back_files.html")) returned 0x20 [0046.392] GetProcessHeap () returned 0x560000 [0046.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.392] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb976eb0, ftCreationTime.dwHighDateTime=0x1d4cd1e, ftLastAccessTime.dwLowDateTime=0x435a6cd0, ftLastAccessTime.dwHighDateTime=0x1d4d23b, ftLastWriteTime.dwLowDateTime=0x435a6cd0, ftLastWriteTime.dwHighDateTime=0x1d4d23b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tyDH", cAlternateFileName="")) returned 1 [0046.392] lstrcmpiW (lpString1="tyDH", lpString2=".") returned 1 [0046.392] lstrcmpiW (lpString1="tyDH", lpString2="..") returned 1 [0046.392] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="tyDH" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH") returned="C:\\Users\\FD1HVy\\Videos\\tyDH" [0046.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tyDH", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.392] GetProcessHeap () returned 0x560000 [0046.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5) returned 0x58a288 [0046.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tyDH", cchWideChar=-1, lpMultiByteStr=0x58a288, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tyDH", lpUsedDefaultChar=0x0) returned 5 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.392] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.393] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.394] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.394] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.394] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.394] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tyDH", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.394] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\" [0046.394] GetProcessHeap () returned 0x560000 [0046.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a2b8 [0046.394] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned 28 [0046.394] GetProcessHeap () returned 0x560000 [0046.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3a) returned 0x572bf0 [0046.394] lstrcpyW (in: lpString1=0x572bf0, lpString2="C:\\Users\\FD1HVy\\Videos\\tyDH\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\" [0046.394] GetProcessHeap () returned 0x560000 [0046.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.394] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37e2fc0, ftCreationTime.dwHighDateTime=0x1d4d1c4, ftLastAccessTime.dwLowDateTime=0xff714ce0, ftLastAccessTime.dwHighDateTime=0x1d4c8b8, ftLastWriteTime.dwLowDateTime=0xff714ce0, ftLastWriteTime.dwHighDateTime=0x1d4c8b8, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uQKvcZcXTn5FWgo8.avi", cAlternateFileName="UQKVCZ~1.AVI")) returned 1 [0046.394] lstrcmpiW (lpString1="uQKvcZcXTn5FWgo8.avi", lpString2=".") returned 1 [0046.394] lstrcmpiW (lpString1="uQKvcZcXTn5FWgo8.avi", lpString2="..") returned 1 [0046.394] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="uQKvcZcXTn5FWgo8.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi") returned="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi" [0046.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="uQKvcZcXTn5FWgo8.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0046.394] GetProcessHeap () returned 0x560000 [0046.394] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576a98 [0046.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="uQKvcZcXTn5FWgo8.avi", cchWideChar=-1, lpMultiByteStr=0x576a98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uQKvcZcXTn5FWgo8.avi", lpUsedDefaultChar=0x0) returned 21 [0046.394] lstrlenA (lpString="uQKvcZcXTn5FWgo8.avi") returned 20 [0046.394] lstrlenA (lpString=".badday") returned 7 [0046.394] lstrlenA (lpString=".badday") returned 7 [0046.394] lstrlenA (lpString="uQKvcZcXTn5FWgo8.avi") returned 20 [0046.394] lstrcmpiA (lpString1="go8.avi", lpString2=".badday") returned 1 [0046.394] lstrcmpiW (lpString1="uQKvcZcXTn5FWgo8.avi", lpString2="how_to_back_files.html") returned 1 [0046.394] lstrcmpiW (lpString1="uQKvcZcXTn5FWgo8.avi", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.394] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.395] lstrcmpiW (lpString1="uQKvcZcXTn5FWgo8.avi", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.395] GetProcessHeap () returned 0x560000 [0046.395] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0046.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi" (normalized: "c:\\users\\fd1hvy\\videos\\uqkvczcxtn5fwgo8.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.395] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2659) returned 1 [0046.395] GetProcessHeap () returned 0x560000 [0046.395] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.395] GetProcessHeap () returned 0x560000 [0046.395] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.395] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi") returned 43 [0046.395] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.395] GetProcessHeap () returned 0x560000 [0046.395] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.395] GetProcessHeap () returned 0x560000 [0046.395] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58dd50 [0046.395] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.395] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.396] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.396] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.396] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.396] lstrlenA (lpString="010001") returned 6 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a368 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c318 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.396] GetProcessHeap () returned 0x560000 [0046.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.396] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c948 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ea8 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.397] GetProcessHeap () returned 0x560000 [0046.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bd78 [0046.397] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ea8 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.399] GetProcessHeap () returned 0x560000 [0046.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.399] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.400] GetProcessHeap () returned 0x560000 [0046.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.401] GetProcessHeap () returned 0x560000 [0046.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.401] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.402] GetProcessHeap () returned 0x560000 [0046.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.402] GetProcessHeap () returned 0x560000 [0046.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0046.403] GetProcessHeap () returned 0x560000 [0046.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.404] GetProcessHeap () returned 0x560000 [0046.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0046.404] GetProcessHeap () returned 0x560000 [0046.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.404] GetProcessHeap () returned 0x560000 [0046.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.404] GetProcessHeap () returned 0x560000 [0046.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.404] WriteFile (in: hFile=0x230, lpBuffer=0x58dd50*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dd50*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0046.405] GetProcessHeap () returned 0x560000 [0046.405] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dd50, Size=0x30) returned 0x58dd50 [0046.405] GetProcessHeap () returned 0x560000 [0046.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.405] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.405] GetProcessHeap () returned 0x560000 [0046.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa70) returned 0x58dd88 [0046.406] ReadFile (in: hFile=0x230, lpBuffer=0x58dd88, nNumberOfBytesToRead=0xa70, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58dd88*, lpNumberOfBytesRead=0x24ad7e8*=0xa70, lpOverlapped=0x0) returned 1 [0046.406] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.406] WriteFile (in: hFile=0x230, lpBuffer=0x58dd88*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58dd88*, lpNumberOfBytesWritten=0x24ad7e4*=0xa70, lpOverlapped=0x0) returned 1 [0046.407] GetProcessHeap () returned 0x560000 [0046.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58dd88 | out: hHeap=0x560000) returned 1 [0046.407] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.407] WriteFile (in: hFile=0x230, lpBuffer=0x58dd50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dd50*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.407] CloseHandle (hObject=0x230) returned 1 [0046.409] GetProcessHeap () returned 0x560000 [0046.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0046.409] GetProcessHeap () returned 0x560000 [0046.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.409] GetProcessHeap () returned 0x560000 [0046.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.409] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi") returned="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi" [0046.409] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi.badday") returned="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi.badday" [0046.409] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi" (normalized: "c:\\users\\fd1hvy\\videos\\uqkvczcxtn5fwgo8.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi.badday" (normalized: "c:\\users\\fd1hvy\\videos\\uqkvczcxtn5fwgo8.avi.badday"), dwFlags=0x1) returned 1 [0046.409] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\uQKvcZcXTn5FWgo8.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0046.409] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0046.409] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" [0046.409] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_to_back_files.html")) returned 0x20 [0046.410] GetProcessHeap () returned 0x560000 [0046.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a98 | out: hHeap=0x560000) returned 1 [0046.410] FindNextFileW (in: hFindFile=0x58d148, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37e2fc0, ftCreationTime.dwHighDateTime=0x1d4d1c4, ftLastAccessTime.dwLowDateTime=0xff714ce0, ftLastAccessTime.dwHighDateTime=0x1d4c8b8, ftLastWriteTime.dwLowDateTime=0xff714ce0, ftLastWriteTime.dwHighDateTime=0x1d4c8b8, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uQKvcZcXTn5FWgo8.avi", cAlternateFileName="UQKVCZ~1.AVI")) returned 0 [0046.410] FindClose (in: hFindFile=0x58d148 | out: hFindFile=0x58d148) returned 1 [0046.410] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\tyDH\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\" [0046.410] GetProcessHeap () returned 0x560000 [0046.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572bf0 | out: hHeap=0x560000) returned 1 [0046.410] GetProcessHeap () returned 0x560000 [0046.410] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.410] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned 28 [0046.410] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\*") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\*" [0046.410] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb976eb0, ftCreationTime.dwHighDateTime=0x1d4cd1e, ftLastAccessTime.dwLowDateTime=0x435a6cd0, ftLastAccessTime.dwHighDateTime=0x1d4d23b, ftLastWriteTime.dwLowDateTime=0x435a6cd0, ftLastWriteTime.dwHighDateTime=0x1d4d23b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58cb88 [0046.411] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.411] FindNextFileW (in: hFindFile=0x58cb88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb976eb0, ftCreationTime.dwHighDateTime=0x1d4cd1e, ftLastAccessTime.dwLowDateTime=0x435a6cd0, ftLastAccessTime.dwHighDateTime=0x1d4d23b, ftLastWriteTime.dwLowDateTime=0x435a6cd0, ftLastWriteTime.dwHighDateTime=0x1d4d23b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.411] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.411] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.411] FindNextFileW (in: hFindFile=0x58cb88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef98920, ftCreationTime.dwHighDateTime=0x1d4c729, ftLastAccessTime.dwLowDateTime=0x58ac9f10, ftLastAccessTime.dwHighDateTime=0x1d4d568, ftLastWriteTime.dwLowDateTime=0x58ac9f10, ftLastWriteTime.dwHighDateTime=0x1d4d568, nFileSizeHigh=0x0, nFileSizeLow=0x659f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lPwCUw8cEX.avi", cAlternateFileName="LPWCUW~1.AVI")) returned 1 [0046.411] lstrcmpiW (lpString1="lPwCUw8cEX.avi", lpString2=".") returned 1 [0046.411] lstrcmpiW (lpString1="lPwCUw8cEX.avi", lpString2="..") returned 1 [0046.411] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="lPwCUw8cEX.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi" [0046.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lPwCUw8cEX.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.411] GetProcessHeap () returned 0x560000 [0046.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0046.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lPwCUw8cEX.avi", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lPwCUw8cEX.avi", lpUsedDefaultChar=0x0) returned 15 [0046.411] lstrlenA (lpString="lPwCUw8cEX.avi") returned 14 [0046.411] lstrlenA (lpString=".badday") returned 7 [0046.411] lstrlenA (lpString=".badday") returned 7 [0046.411] lstrlenA (lpString="lPwCUw8cEX.avi") returned 14 [0046.411] lstrcmpiA (lpString1="cEX.avi", lpString2=".badday") returned 1 [0046.411] lstrcmpiW (lpString1="lPwCUw8cEX.avi", lpString2="how_to_back_files.html") returned 1 [0046.411] lstrcmpiW (lpString1="lPwCUw8cEX.avi", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.411] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.411] lstrcmpiW (lpString1="lPwCUw8cEX.avi", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.411] GetProcessHeap () returned 0x560000 [0046.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0046.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\lpwcuw8cex.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.411] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=26015) returned 1 [0046.412] GetProcessHeap () returned 0x560000 [0046.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.412] GetProcessHeap () returned 0x560000 [0046.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.412] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi") returned 42 [0046.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.412] GetProcessHeap () returned 0x560000 [0046.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.412] GetProcessHeap () returned 0x560000 [0046.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58dd88 [0046.412] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.412] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.412] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.412] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.412] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.413] lstrlenA (lpString="010001") returned 6 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2f8 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c9d8 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a358 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589f08 [0046.413] GetProcessHeap () returned 0x560000 [0046.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be98 [0046.413] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be98 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e90 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c318 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e90 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.414] GetProcessHeap () returned 0x560000 [0046.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.415] GetProcessHeap () returned 0x560000 [0046.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.416] GetProcessHeap () returned 0x560000 [0046.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.416] GetProcessHeap () returned 0x560000 [0046.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.416] GetProcessHeap () returned 0x560000 [0046.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.416] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.417] GetProcessHeap () returned 0x560000 [0046.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.418] GetProcessHeap () returned 0x560000 [0046.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.419] GetProcessHeap () returned 0x560000 [0046.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.419] GetProcessHeap () returned 0x560000 [0046.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f08 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.420] GetProcessHeap () returned 0x560000 [0046.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.420] WriteFile (in: hFile=0x230, lpBuffer=0x58dd88*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dd88*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.422] GetProcessHeap () returned 0x560000 [0046.422] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dd88, Size=0x30) returned 0x58dd88 [0046.422] GetProcessHeap () returned 0x560000 [0046.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.422] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.422] GetProcessHeap () returned 0x560000 [0046.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x659f) returned 0x5a13b8 [0046.422] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x659f, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x659f, lpOverlapped=0x0) returned 1 [0046.423] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.423] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x659f, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x659f, lpOverlapped=0x0) returned 1 [0046.424] GetProcessHeap () returned 0x560000 [0046.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.424] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.424] WriteFile (in: hFile=0x230, lpBuffer=0x58dd88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dd88*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.425] CloseHandle (hObject=0x230) returned 1 [0046.427] GetProcessHeap () returned 0x560000 [0046.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0046.427] GetProcessHeap () returned 0x560000 [0046.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.427] GetProcessHeap () returned 0x560000 [0046.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.427] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi" [0046.427] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi.badday") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi.badday" [0046.427] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\lpwcuw8cex.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi.badday" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\lpwcuw8cex.avi.badday"), dwFlags=0x1) returned 1 [0046.428] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH\\lPwCUw8cEX.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH") returned 1 [0046.428] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned="" [0046.428] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" [0046.428] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\how_to_back_files.html")) returned 0xffffffff [0046.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0046.429] GetProcessHeap () returned 0x560000 [0046.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.429] GetProcessHeap () returned 0x560000 [0046.429] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.435] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.436] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.436] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.436] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.441] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.442] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.444] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.447] GetProcessHeap () returned 0x560000 [0046.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.447] GetProcessHeap () returned 0x560000 [0046.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.447] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0046.447] GetProcessHeap () returned 0x560000 [0046.447] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.447] GetProcessHeap () returned 0x560000 [0046.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.454] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.455] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.456] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.461] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.480] GetProcessHeap () returned 0x560000 [0046.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.480] GetProcessHeap () returned 0x560000 [0046.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.480] CloseHandle (hObject=0x230) returned 1 [0046.480] GetProcessHeap () returned 0x560000 [0046.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.480] FindNextFileW (in: hFindFile=0x58cb88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb35d1390, ftCreationTime.dwHighDateTime=0x1d4d40a, ftLastAccessTime.dwLowDateTime=0x2ad59f20, ftLastAccessTime.dwHighDateTime=0x1d4d52b, ftLastWriteTime.dwLowDateTime=0x2ad59f20, ftLastWriteTime.dwHighDateTime=0x1d4d52b, nFileSizeHigh=0x0, nFileSizeLow=0xb085, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oFdCkaz-kpeof_PBG7r.swf", cAlternateFileName="OFDCKA~1.SWF")) returned 1 [0046.480] lstrcmpiW (lpString1="oFdCkaz-kpeof_PBG7r.swf", lpString2=".") returned 1 [0046.480] lstrcmpiW (lpString1="oFdCkaz-kpeof_PBG7r.swf", lpString2="..") returned 1 [0046.480] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="oFdCkaz-kpeof_PBG7r.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf" [0046.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oFdCkaz-kpeof_PBG7r.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0046.480] GetProcessHeap () returned 0x560000 [0046.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5769f8 [0046.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oFdCkaz-kpeof_PBG7r.swf", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oFdCkaz-kpeof_PBG7r.swf", lpUsedDefaultChar=0x0) returned 24 [0046.480] lstrlenA (lpString="oFdCkaz-kpeof_PBG7r.swf") returned 23 [0046.481] lstrlenA (lpString=".badday") returned 7 [0046.481] lstrlenA (lpString=".badday") returned 7 [0046.481] lstrlenA (lpString="oFdCkaz-kpeof_PBG7r.swf") returned 23 [0046.481] lstrcmpiA (lpString1="G7r.swf", lpString2=".badday") returned 1 [0046.481] lstrcmpiW (lpString1="oFdCkaz-kpeof_PBG7r.swf", lpString2="how_to_back_files.html") returned 1 [0046.481] lstrcmpiW (lpString1="oFdCkaz-kpeof_PBG7r.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.481] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.481] lstrcmpiW (lpString1="oFdCkaz-kpeof_PBG7r.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.481] GetProcessHeap () returned 0x560000 [0046.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0046.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\ofdckaz-kpeof_pbg7r.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.481] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=45189) returned 1 [0046.481] GetProcessHeap () returned 0x560000 [0046.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.481] GetProcessHeap () returned 0x560000 [0046.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.481] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf") returned 51 [0046.481] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.481] GetProcessHeap () returned 0x560000 [0046.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.481] GetProcessHeap () returned 0x560000 [0046.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58ddc0 [0046.481] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.482] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.482] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.482] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.482] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.482] GetProcessHeap () returned 0x560000 [0046.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.482] lstrlenA (lpString="010001") returned 6 [0046.482] GetProcessHeap () returned 0x560000 [0046.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a368 [0046.482] GetProcessHeap () returned 0x560000 [0046.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.482] GetProcessHeap () returned 0x560000 [0046.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c558 [0046.482] GetProcessHeap () returned 0x560000 [0046.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfb8 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2d8 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf28 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0046.483] GetProcessHeap () returned 0x560000 [0046.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.483] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c5e8 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.484] GetProcessHeap () returned 0x560000 [0046.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.484] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.485] GetProcessHeap () returned 0x560000 [0046.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.486] GetProcessHeap () returned 0x560000 [0046.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.487] GetProcessHeap () returned 0x560000 [0046.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.488] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.489] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfb8 | out: hHeap=0x560000) returned 1 [0046.489] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0046.489] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c558 | out: hHeap=0x560000) returned 1 [0046.489] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.489] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.489] GetProcessHeap () returned 0x560000 [0046.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.489] WriteFile (in: hFile=0x230, lpBuffer=0x58ddc0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ddc0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.503] GetProcessHeap () returned 0x560000 [0046.503] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58ddc0, Size=0x30) returned 0x58ddc0 [0046.503] GetProcessHeap () returned 0x560000 [0046.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.503] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.503] GetProcessHeap () returned 0x560000 [0046.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb085) returned 0x5a13b8 [0046.503] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0xb085, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0xb085, lpOverlapped=0x0) returned 1 [0046.504] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.504] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0xb085, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xb085, lpOverlapped=0x0) returned 1 [0046.505] GetProcessHeap () returned 0x560000 [0046.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.507] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.507] WriteFile (in: hFile=0x230, lpBuffer=0x58ddc0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ddc0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.508] CloseHandle (hObject=0x230) returned 1 [0046.510] GetProcessHeap () returned 0x560000 [0046.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0046.510] GetProcessHeap () returned 0x560000 [0046.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.510] GetProcessHeap () returned 0x560000 [0046.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.510] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf" [0046.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf.badday" [0046.510] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\ofdckaz-kpeof_pbg7r.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\ofdckaz-kpeof_pbg7r.swf.badday"), dwFlags=0x1) returned 1 [0046.512] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH\\oFdCkaz-kpeof_PBG7r.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH") returned 1 [0046.512] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned="" [0046.512] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" [0046.512] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\how_to_back_files.html")) returned 0x20 [0046.512] GetProcessHeap () returned 0x560000 [0046.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0046.512] FindNextFileW (in: hFindFile=0x58cb88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a87c740, ftCreationTime.dwHighDateTime=0x1d4d5e2, ftLastAccessTime.dwLowDateTime=0x671ca7e0, ftLastAccessTime.dwHighDateTime=0x1d4c968, ftLastWriteTime.dwLowDateTime=0x671ca7e0, ftLastWriteTime.dwHighDateTime=0x1d4c968, nFileSizeHigh=0x0, nFileSizeLow=0x108ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wQ3UlUMOF_3Dfh2.avi", cAlternateFileName="WQ3ULU~1.AVI")) returned 1 [0046.512] lstrcmpiW (lpString1="wQ3UlUMOF_3Dfh2.avi", lpString2=".") returned 1 [0046.512] lstrcmpiW (lpString1="wQ3UlUMOF_3Dfh2.avi", lpString2="..") returned 1 [0046.512] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="wQ3UlUMOF_3Dfh2.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi" [0046.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wQ3UlUMOF_3Dfh2.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.512] GetProcessHeap () returned 0x560000 [0046.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576b58 [0046.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wQ3UlUMOF_3Dfh2.avi", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wQ3UlUMOF_3Dfh2.avi", lpUsedDefaultChar=0x0) returned 20 [0046.512] lstrlenA (lpString="wQ3UlUMOF_3Dfh2.avi") returned 19 [0046.512] lstrlenA (lpString=".badday") returned 7 [0046.512] lstrlenA (lpString=".badday") returned 7 [0046.512] lstrlenA (lpString="wQ3UlUMOF_3Dfh2.avi") returned 19 [0046.513] lstrcmpiA (lpString1="fh2.avi", lpString2=".badday") returned 1 [0046.513] lstrcmpiW (lpString1="wQ3UlUMOF_3Dfh2.avi", lpString2="how_to_back_files.html") returned 1 [0046.513] lstrcmpiW (lpString1="wQ3UlUMOF_3Dfh2.avi", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.513] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.513] lstrcmpiW (lpString1="wQ3UlUMOF_3Dfh2.avi", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.513] GetProcessHeap () returned 0x560000 [0046.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0046.513] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\wq3ulumof_3dfh2.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.513] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=67839) returned 1 [0046.513] GetProcessHeap () returned 0x560000 [0046.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.513] GetProcessHeap () returned 0x560000 [0046.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.513] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi") returned 47 [0046.513] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.513] GetProcessHeap () returned 0x560000 [0046.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.513] GetProcessHeap () returned 0x560000 [0046.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x58ddf8 [0046.513] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.513] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.514] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.514] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.514] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.514] lstrlenA (lpString="010001") returned 6 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a358 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf28 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bd78 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2f8 [0046.514] GetProcessHeap () returned 0x560000 [0046.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c318 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e30 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c288 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e30 | out: hHeap=0x560000) returned 1 [0046.515] GetProcessHeap () returned 0x560000 [0046.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0046.515] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c288 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.516] GetProcessHeap () returned 0x560000 [0046.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.517] GetProcessHeap () returned 0x560000 [0046.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.518] GetProcessHeap () returned 0x560000 [0046.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.519] GetProcessHeap () returned 0x560000 [0046.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.520] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.521] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0046.521] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.521] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0046.521] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0046.521] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.521] GetProcessHeap () returned 0x560000 [0046.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.521] WriteFile (in: hFile=0x230, lpBuffer=0x58ddf8*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ddf8*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0046.523] GetProcessHeap () returned 0x560000 [0046.523] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58ddf8, Size=0x30) returned 0x58ddf8 [0046.523] GetProcessHeap () returned 0x560000 [0046.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.523] GetProcessHeap () returned 0x560000 [0046.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10900) returned 0x5a13b8 [0046.525] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x10900, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x10900, lpOverlapped=0x0) returned 1 [0046.526] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.526] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x10900, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x10900, lpOverlapped=0x0) returned 1 [0046.528] GetProcessHeap () returned 0x560000 [0046.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.528] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.528] WriteFile (in: hFile=0x230, lpBuffer=0x58ddf8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ddf8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.528] CloseHandle (hObject=0x230) returned 1 [0046.542] GetProcessHeap () returned 0x560000 [0046.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0046.542] GetProcessHeap () returned 0x560000 [0046.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.542] GetProcessHeap () returned 0x560000 [0046.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.542] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi" [0046.542] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi.badday") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi.badday" [0046.542] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\wq3ulumof_3dfh2.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi.badday" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\wq3ulumof_3dfh2.avi.badday"), dwFlags=0x1) returned 1 [0046.542] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH\\wQ3UlUMOF_3Dfh2.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH") returned 1 [0046.542] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\tyDH\\") returned="" [0046.542] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" [0046.543] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tyDH\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\tydh\\how_to_back_files.html")) returned 0x20 [0046.543] GetProcessHeap () returned 0x560000 [0046.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0046.543] FindNextFileW (in: hFindFile=0x58cb88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a87c740, ftCreationTime.dwHighDateTime=0x1d4d5e2, ftLastAccessTime.dwLowDateTime=0x671ca7e0, ftLastAccessTime.dwHighDateTime=0x1d4c968, ftLastWriteTime.dwLowDateTime=0x671ca7e0, ftLastWriteTime.dwHighDateTime=0x1d4c968, nFileSizeHigh=0x0, nFileSizeLow=0x108ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wQ3UlUMOF_3Dfh2.avi", cAlternateFileName="WQ3ULU~1.AVI")) returned 0 [0046.543] FindClose (in: hFindFile=0x58cb88 | out: hFindFile=0x58cb88) returned 1 [0046.543] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\" [0046.543] GetProcessHeap () returned 0x560000 [0046.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0046.543] GetProcessHeap () returned 0x560000 [0046.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.543] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned 44 [0046.543] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\*") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\*" [0046.543] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60204f50, ftCreationTime.dwHighDateTime=0x1d4c7e7, ftLastAccessTime.dwLowDateTime=0xd97fa780, ftLastAccessTime.dwHighDateTime=0x1d4ccd1, ftLastWriteTime.dwLowDateTime=0xd97fa780, ftLastWriteTime.dwHighDateTime=0x1d4ccd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58d048 [0046.543] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.543] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60204f50, ftCreationTime.dwHighDateTime=0x1d4c7e7, ftLastAccessTime.dwLowDateTime=0xd97fa780, ftLastAccessTime.dwHighDateTime=0x1d4ccd1, ftLastWriteTime.dwLowDateTime=0xd97fa780, ftLastWriteTime.dwHighDateTime=0x1d4ccd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.543] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.543] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.543] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc25aaf00, ftCreationTime.dwHighDateTime=0x1d4ca7e, ftLastAccessTime.dwLowDateTime=0x9ab4d160, ftLastAccessTime.dwHighDateTime=0x1d4c67d, ftLastWriteTime.dwLowDateTime=0x9ab4d160, ftLastWriteTime.dwHighDateTime=0x1d4c67d, nFileSizeHigh=0x0, nFileSizeLow=0xc060, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aaBmLyaBJYHF93.mkv", cAlternateFileName="AABMLY~1.MKV")) returned 1 [0046.543] lstrcmpiW (lpString1="aaBmLyaBJYHF93.mkv", lpString2=".") returned 1 [0046.543] lstrcmpiW (lpString1="aaBmLyaBJYHF93.mkv", lpString2="..") returned 1 [0046.543] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="aaBmLyaBJYHF93.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv" [0046.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aaBmLyaBJYHF93.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0046.543] GetProcessHeap () returned 0x560000 [0046.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576b18 [0046.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aaBmLyaBJYHF93.mkv", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aaBmLyaBJYHF93.mkv", lpUsedDefaultChar=0x0) returned 19 [0046.544] lstrlenA (lpString="aaBmLyaBJYHF93.mkv") returned 18 [0046.544] lstrlenA (lpString=".badday") returned 7 [0046.544] lstrlenA (lpString=".badday") returned 7 [0046.544] lstrlenA (lpString="aaBmLyaBJYHF93.mkv") returned 18 [0046.544] lstrcmpiA (lpString1="F93.mkv", lpString2=".badday") returned 1 [0046.544] lstrcmpiW (lpString1="aaBmLyaBJYHF93.mkv", lpString2="how_to_back_files.html") returned -1 [0046.544] lstrcmpiW (lpString1="aaBmLyaBJYHF93.mkv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.544] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.544] lstrcmpiW (lpString1="aaBmLyaBJYHF93.mkv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.544] GetProcessHeap () returned 0x560000 [0046.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0046.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\aabmlyabjyhf93.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.544] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=49248) returned 1 [0046.544] GetProcessHeap () returned 0x560000 [0046.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.544] GetProcessHeap () returned 0x560000 [0046.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.544] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv") returned 62 [0046.544] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.544] GetProcessHeap () returned 0x560000 [0046.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.544] GetProcessHeap () returned 0x560000 [0046.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58de30 [0046.544] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.545] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.545] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.545] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.545] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.545] GetProcessHeap () returned 0x560000 [0046.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.545] lstrlenA (lpString="010001") returned 6 [0046.545] GetProcessHeap () returned 0x560000 [0046.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2d8 [0046.545] GetProcessHeap () returned 0x560000 [0046.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.545] GetProcessHeap () returned 0x560000 [0046.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c0d8 [0046.545] GetProcessHeap () returned 0x560000 [0046.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.545] GetProcessHeap () returned 0x560000 [0046.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c948 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4c8 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4c8 | out: hHeap=0x560000) returned 1 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d88 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.546] GetProcessHeap () returned 0x560000 [0046.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.546] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c828 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d88 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c828 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.547] GetProcessHeap () returned 0x560000 [0046.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.548] GetProcessHeap () returned 0x560000 [0046.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.548] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.549] GetProcessHeap () returned 0x560000 [0046.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.549] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.550] GetProcessHeap () returned 0x560000 [0046.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c948 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.551] GetProcessHeap () returned 0x560000 [0046.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0046.552] GetProcessHeap () returned 0x560000 [0046.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0046.552] GetProcessHeap () returned 0x560000 [0046.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.552] GetProcessHeap () returned 0x560000 [0046.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.552] WriteFile (in: hFile=0x230, lpBuffer=0x58de30*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58de30*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.553] GetProcessHeap () returned 0x560000 [0046.553] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58de30, Size=0x30) returned 0x58de30 [0046.554] GetProcessHeap () returned 0x560000 [0046.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.554] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.554] GetProcessHeap () returned 0x560000 [0046.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc060) returned 0x5a13b8 [0046.554] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0xc060, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0xc060, lpOverlapped=0x0) returned 1 [0046.554] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.555] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xc060, lpOverlapped=0x0) returned 1 [0046.556] GetProcessHeap () returned 0x560000 [0046.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.556] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.556] WriteFile (in: hFile=0x230, lpBuffer=0x58de30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58de30*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.557] CloseHandle (hObject=0x230) returned 1 [0046.559] GetProcessHeap () returned 0x560000 [0046.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0046.559] GetProcessHeap () returned 0x560000 [0046.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.559] GetProcessHeap () returned 0x560000 [0046.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.559] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv" [0046.559] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv.badday") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv.badday" [0046.559] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\aabmlyabjyhf93.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\aabmlyabjyhf93.mkv.badday"), dwFlags=0x1) returned 1 [0046.560] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\aaBmLyaBJYHF93.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X") returned 1 [0046.560] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="" [0046.560] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" [0046.560] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\how_to_back_files.html")) returned 0xffffffff [0046.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0046.560] GetProcessHeap () returned 0x560000 [0046.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.560] GetProcessHeap () returned 0x560000 [0046.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.578] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.579] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.580] GetProcessHeap () returned 0x560000 [0046.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.580] GetProcessHeap () returned 0x560000 [0046.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.581] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0046.581] GetProcessHeap () returned 0x560000 [0046.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.581] GetProcessHeap () returned 0x560000 [0046.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.609] GetProcessHeap () returned 0x560000 [0046.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.609] GetProcessHeap () returned 0x560000 [0046.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.609] CloseHandle (hObject=0x230) returned 1 [0046.610] GetProcessHeap () returned 0x560000 [0046.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b18 | out: hHeap=0x560000) returned 1 [0046.610] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621d3ee0, ftCreationTime.dwHighDateTime=0x1d4c836, ftLastAccessTime.dwLowDateTime=0x5c4f420, ftLastAccessTime.dwHighDateTime=0x1d4cbc0, ftLastWriteTime.dwLowDateTime=0x5c4f420, ftLastWriteTime.dwHighDateTime=0x1d4cbc0, nFileSizeHigh=0x0, nFileSizeLow=0xe76c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Guh1FizS0G.swf", cAlternateFileName="GUH1FI~1.SWF")) returned 1 [0046.610] lstrcmpiW (lpString1="Guh1FizS0G.swf", lpString2=".") returned 1 [0046.610] lstrcmpiW (lpString1="Guh1FizS0G.swf", lpString2="..") returned 1 [0046.610] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="Guh1FizS0G.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf" [0046.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Guh1FizS0G.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.610] GetProcessHeap () returned 0x560000 [0046.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0046.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Guh1FizS0G.swf", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Guh1FizS0G.swf", lpUsedDefaultChar=0x0) returned 15 [0046.610] lstrlenA (lpString="Guh1FizS0G.swf") returned 14 [0046.610] lstrlenA (lpString=".badday") returned 7 [0046.610] lstrlenA (lpString=".badday") returned 7 [0046.610] lstrlenA (lpString="Guh1FizS0G.swf") returned 14 [0046.610] lstrcmpiA (lpString1="S0G.swf", lpString2=".badday") returned 1 [0046.610] lstrcmpiW (lpString1="Guh1FizS0G.swf", lpString2="how_to_back_files.html") returned -1 [0046.610] lstrcmpiW (lpString1="Guh1FizS0G.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.610] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.610] lstrcmpiW (lpString1="Guh1FizS0G.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.610] GetProcessHeap () returned 0x560000 [0046.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0046.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\guh1fizs0g.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.611] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=59244) returned 1 [0046.611] GetProcessHeap () returned 0x560000 [0046.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.611] GetProcessHeap () returned 0x560000 [0046.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.611] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf") returned 58 [0046.611] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.611] GetProcessHeap () returned 0x560000 [0046.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.611] GetProcessHeap () returned 0x560000 [0046.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58de68 [0046.611] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.611] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.612] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.612] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.612] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.612] lstrlenA (lpString="010001") returned 6 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2b8 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a308 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.612] GetProcessHeap () returned 0x560000 [0046.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.612] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfb8 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfb8 | out: hHeap=0x560000) returned 1 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bc0 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.613] GetProcessHeap () returned 0x560000 [0046.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c0d8 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bc0 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.614] GetProcessHeap () returned 0x560000 [0046.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.614] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.615] GetProcessHeap () returned 0x560000 [0046.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.616] GetProcessHeap () returned 0x560000 [0046.616] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.616] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.617] GetProcessHeap () returned 0x560000 [0046.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.618] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0046.618] GetProcessHeap () returned 0x560000 [0046.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.619] GetProcessHeap () returned 0x560000 [0046.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.619] GetProcessHeap () returned 0x560000 [0046.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.619] WriteFile (in: hFile=0x230, lpBuffer=0x58de68*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58de68*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.621] GetProcessHeap () returned 0x560000 [0046.621] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58de68, Size=0x30) returned 0x58de68 [0046.621] GetProcessHeap () returned 0x560000 [0046.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.621] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.621] GetProcessHeap () returned 0x560000 [0046.621] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe76c) returned 0x5a13b8 [0046.621] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0xe76c, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0xe76c, lpOverlapped=0x0) returned 1 [0046.622] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.622] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0xe76c, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xe76c, lpOverlapped=0x0) returned 1 [0046.623] GetProcessHeap () returned 0x560000 [0046.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.624] WriteFile (in: hFile=0x230, lpBuffer=0x58de68*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58de68*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.625] CloseHandle (hObject=0x230) returned 1 [0046.627] GetProcessHeap () returned 0x560000 [0046.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0046.627] GetProcessHeap () returned 0x560000 [0046.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.627] GetProcessHeap () returned 0x560000 [0046.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.627] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf" [0046.627] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf.badday" [0046.628] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\guh1fizs0g.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\guh1fizs0g.swf.badday"), dwFlags=0x1) returned 1 [0046.628] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\Guh1FizS0G.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X") returned 1 [0046.628] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="" [0046.628] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" [0046.628] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\how_to_back_files.html")) returned 0x20 [0046.628] GetProcessHeap () returned 0x560000 [0046.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.628] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x124278d0, ftCreationTime.dwHighDateTime=0x1d4d034, ftLastAccessTime.dwLowDateTime=0x3b18b850, ftLastAccessTime.dwHighDateTime=0x1d4d241, ftLastWriteTime.dwLowDateTime=0x3b18b850, ftLastWriteTime.dwHighDateTime=0x1d4d241, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LzzuM_RZQ_.swf", cAlternateFileName="LZZUM_~1.SWF")) returned 1 [0046.628] lstrcmpiW (lpString1="LzzuM_RZQ_.swf", lpString2=".") returned 1 [0046.628] lstrcmpiW (lpString1="LzzuM_RZQ_.swf", lpString2="..") returned 1 [0046.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="LzzuM_RZQ_.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf" [0046.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LzzuM_RZQ_.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.629] GetProcessHeap () returned 0x560000 [0046.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0046.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LzzuM_RZQ_.swf", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LzzuM_RZQ_.swf", lpUsedDefaultChar=0x0) returned 15 [0046.629] lstrlenA (lpString="LzzuM_RZQ_.swf") returned 14 [0046.629] lstrlenA (lpString=".badday") returned 7 [0046.629] lstrlenA (lpString=".badday") returned 7 [0046.629] lstrlenA (lpString="LzzuM_RZQ_.swf") returned 14 [0046.629] lstrcmpiA (lpString1="ZQ_.swf", lpString2=".badday") returned 1 [0046.629] lstrcmpiW (lpString1="LzzuM_RZQ_.swf", lpString2="how_to_back_files.html") returned 1 [0046.629] lstrcmpiW (lpString1="LzzuM_RZQ_.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.629] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.629] lstrcmpiW (lpString1="LzzuM_RZQ_.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.629] GetProcessHeap () returned 0x560000 [0046.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0046.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\lzzum_rzq_.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.629] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=4032) returned 1 [0046.629] GetProcessHeap () returned 0x560000 [0046.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.629] GetProcessHeap () returned 0x560000 [0046.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.629] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf") returned 58 [0046.629] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.629] GetProcessHeap () returned 0x560000 [0046.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.630] GetProcessHeap () returned 0x560000 [0046.630] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58dea0 [0046.631] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.631] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.631] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.631] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.631] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.631] GetProcessHeap () returned 0x560000 [0046.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.631] lstrlenA (lpString="010001") returned 6 [0046.631] GetProcessHeap () returned 0x560000 [0046.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a298 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c438 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2f8 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c68 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0046.632] GetProcessHeap () returned 0x560000 [0046.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0046.632] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d40 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c048 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d40 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.633] GetProcessHeap () returned 0x560000 [0046.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.633] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.634] GetProcessHeap () returned 0x560000 [0046.634] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.635] GetProcessHeap () returned 0x560000 [0046.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.636] GetProcessHeap () returned 0x560000 [0046.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.637] GetProcessHeap () returned 0x560000 [0046.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c68 | out: hHeap=0x560000) returned 1 [0046.638] GetProcessHeap () returned 0x560000 [0046.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c438 | out: hHeap=0x560000) returned 1 [0046.638] GetProcessHeap () returned 0x560000 [0046.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.638] GetProcessHeap () returned 0x560000 [0046.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0046.638] GetProcessHeap () returned 0x560000 [0046.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.638] GetProcessHeap () returned 0x560000 [0046.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.638] GetProcessHeap () returned 0x560000 [0046.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.638] WriteFile (in: hFile=0x230, lpBuffer=0x58dea0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dea0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.640] GetProcessHeap () returned 0x560000 [0046.640] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dea0, Size=0x30) returned 0x58dea0 [0046.640] GetProcessHeap () returned 0x560000 [0046.640] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.640] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.641] GetProcessHeap () returned 0x560000 [0046.641] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfc0) returned 0x5a13b8 [0046.642] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0xfc0, lpOverlapped=0x0) returned 1 [0046.642] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.642] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xfc0, lpOverlapped=0x0) returned 1 [0046.643] GetProcessHeap () returned 0x560000 [0046.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.643] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.643] WriteFile (in: hFile=0x230, lpBuffer=0x58dea0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dea0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.643] CloseHandle (hObject=0x230) returned 1 [0046.647] GetProcessHeap () returned 0x560000 [0046.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0046.647] GetProcessHeap () returned 0x560000 [0046.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.647] GetProcessHeap () returned 0x560000 [0046.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.647] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf" [0046.647] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf.badday" [0046.647] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\lzzum_rzq_.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\lzzum_rzq_.swf.badday"), dwFlags=0x1) returned 1 [0046.648] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\LzzuM_RZQ_.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X") returned 1 [0046.648] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="" [0046.648] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" [0046.648] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\how_to_back_files.html")) returned 0x20 [0046.648] GetProcessHeap () returned 0x560000 [0046.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.648] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd158ae70, ftCreationTime.dwHighDateTime=0x1d4cdbd, ftLastAccessTime.dwLowDateTime=0x9dd15880, ftLastAccessTime.dwHighDateTime=0x1d4cf21, ftLastWriteTime.dwLowDateTime=0x9dd15880, ftLastWriteTime.dwHighDateTime=0x1d4cf21, nFileSizeHigh=0x0, nFileSizeLow=0x123f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tISGyI1coOjtK1.swf", cAlternateFileName="TISGYI~1.SWF")) returned 1 [0046.648] lstrcmpiW (lpString1="tISGyI1coOjtK1.swf", lpString2=".") returned 1 [0046.648] lstrcmpiW (lpString1="tISGyI1coOjtK1.swf", lpString2="..") returned 1 [0046.648] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="tISGyI1coOjtK1.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf" [0046.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tISGyI1coOjtK1.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0046.648] GetProcessHeap () returned 0x560000 [0046.648] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0046.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tISGyI1coOjtK1.swf", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tISGyI1coOjtK1.swf", lpUsedDefaultChar=0x0) returned 19 [0046.648] lstrlenA (lpString="tISGyI1coOjtK1.swf") returned 18 [0046.649] lstrlenA (lpString=".badday") returned 7 [0046.649] lstrlenA (lpString=".badday") returned 7 [0046.649] lstrlenA (lpString="tISGyI1coOjtK1.swf") returned 18 [0046.649] lstrcmpiA (lpString1="tK1.swf", lpString2=".badday") returned 1 [0046.649] lstrcmpiW (lpString1="tISGyI1coOjtK1.swf", lpString2="how_to_back_files.html") returned 1 [0046.649] lstrcmpiW (lpString1="tISGyI1coOjtK1.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.649] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.649] lstrcmpiW (lpString1="tISGyI1coOjtK1.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.649] GetProcessHeap () returned 0x560000 [0046.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0046.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\tisgyi1coojtk1.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.649] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=74744) returned 1 [0046.649] GetProcessHeap () returned 0x560000 [0046.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.649] GetProcessHeap () returned 0x560000 [0046.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.649] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf") returned 62 [0046.649] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.649] GetProcessHeap () returned 0x560000 [0046.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.649] GetProcessHeap () returned 0x560000 [0046.649] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58ded8 [0046.649] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.649] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.650] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.650] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.650] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.650] lstrlenA (lpString="010001") returned 6 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c318 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca68 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0046.650] GetProcessHeap () returned 0x560000 [0046.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a248 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c9d8 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b60 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c708 [0046.651] GetProcessHeap () returned 0x560000 [0046.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b60 | out: hHeap=0x560000) returned 1 [0046.651] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.652] GetProcessHeap () returned 0x560000 [0046.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.653] GetProcessHeap () returned 0x560000 [0046.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.654] GetProcessHeap () returned 0x560000 [0046.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.655] GetProcessHeap () returned 0x560000 [0046.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.655] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0046.656] GetProcessHeap () returned 0x560000 [0046.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.657] GetProcessHeap () returned 0x560000 [0046.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.657] WriteFile (in: hFile=0x230, lpBuffer=0x58ded8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ded8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.659] GetProcessHeap () returned 0x560000 [0046.659] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58ded8, Size=0x30) returned 0x58ded8 [0046.659] GetProcessHeap () returned 0x560000 [0046.659] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.659] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.659] GetProcessHeap () returned 0x560000 [0046.659] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x123f8) returned 0x5a13b8 [0046.660] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x123f8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x123f8, lpOverlapped=0x0) returned 1 [0046.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.662] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x123f8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x123f8, lpOverlapped=0x0) returned 1 [0046.663] GetProcessHeap () returned 0x560000 [0046.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.665] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.665] WriteFile (in: hFile=0x230, lpBuffer=0x58ded8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58ded8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.666] CloseHandle (hObject=0x230) returned 1 [0046.668] GetProcessHeap () returned 0x560000 [0046.668] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0046.668] GetProcessHeap () returned 0x560000 [0046.668] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.668] GetProcessHeap () returned 0x560000 [0046.668] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.668] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf" [0046.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf.badday" [0046.668] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\tisgyi1coojtk1.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\tisgyi1coojtk1.swf.badday"), dwFlags=0x1) returned 1 [0046.669] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\tISGyI1coOjtK1.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X") returned 1 [0046.669] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="" [0046.669] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" [0046.669] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\how_to_back_files.html")) returned 0x20 [0046.669] GetProcessHeap () returned 0x560000 [0046.669] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0046.669] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabf61820, ftCreationTime.dwHighDateTime=0x1d4d493, ftLastAccessTime.dwLowDateTime=0x2c4fc330, ftLastAccessTime.dwHighDateTime=0x1d4cdb0, ftLastWriteTime.dwLowDateTime=0x2c4fc330, ftLastWriteTime.dwHighDateTime=0x1d4cdb0, nFileSizeHigh=0x0, nFileSizeLow=0x15c53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WS5fX-K AYxB.swf", cAlternateFileName="WS5FX-~1.SWF")) returned 1 [0046.669] lstrcmpiW (lpString1="WS5fX-K AYxB.swf", lpString2=".") returned 1 [0046.669] lstrcmpiW (lpString1="WS5fX-K AYxB.swf", lpString2="..") returned 1 [0046.669] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="WS5fX-K AYxB.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf" [0046.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WS5fX-K AYxB.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.669] GetProcessHeap () returned 0x560000 [0046.669] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576818 [0046.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WS5fX-K AYxB.swf", cchWideChar=-1, lpMultiByteStr=0x576818, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WS5fX-K AYxB.swf", lpUsedDefaultChar=0x0) returned 17 [0046.669] lstrlenA (lpString="WS5fX-K AYxB.swf") returned 16 [0046.669] lstrlenA (lpString=".badday") returned 7 [0046.669] lstrlenA (lpString=".badday") returned 7 [0046.669] lstrlenA (lpString="WS5fX-K AYxB.swf") returned 16 [0046.669] lstrcmpiA (lpString1="YxB.swf", lpString2=".badday") returned 1 [0046.669] lstrcmpiW (lpString1="WS5fX-K AYxB.swf", lpString2="how_to_back_files.html") returned 1 [0046.669] lstrcmpiW (lpString1="WS5fX-K AYxB.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.669] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.670] lstrcmpiW (lpString1="WS5fX-K AYxB.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.670] GetProcessHeap () returned 0x560000 [0046.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0046.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\ws5fx-k ayxb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.670] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=89171) returned 1 [0046.670] GetProcessHeap () returned 0x560000 [0046.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.670] GetProcessHeap () returned 0x560000 [0046.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.670] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf") returned 60 [0046.670] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.670] GetProcessHeap () returned 0x560000 [0046.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.670] GetProcessHeap () returned 0x560000 [0046.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58df10 [0046.670] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.670] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.671] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.671] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.671] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.671] lstrlenA (lpString="010001") returned 6 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a308 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c0d8 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0046.671] GetProcessHeap () returned 0x560000 [0046.671] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8b8 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8b8 | out: hHeap=0x560000) returned 1 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ed8 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca68 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ed8 | out: hHeap=0x560000) returned 1 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.672] GetProcessHeap () returned 0x560000 [0046.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.673] GetProcessHeap () returned 0x560000 [0046.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.674] GetProcessHeap () returned 0x560000 [0046.674] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.675] GetProcessHeap () returned 0x560000 [0046.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.675] GetProcessHeap () returned 0x560000 [0046.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.675] GetProcessHeap () returned 0x560000 [0046.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.675] GetProcessHeap () returned 0x560000 [0046.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.675] GetProcessHeap () returned 0x560000 [0046.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.675] GetProcessHeap () returned 0x560000 [0046.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.675] GetProcessHeap () returned 0x560000 [0046.686] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.686] GetProcessHeap () returned 0x560000 [0046.686] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.686] GetProcessHeap () returned 0x560000 [0046.686] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.686] GetProcessHeap () returned 0x560000 [0046.686] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.687] GetProcessHeap () returned 0x560000 [0046.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.688] GetProcessHeap () returned 0x560000 [0046.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c0d8 | out: hHeap=0x560000) returned 1 [0046.689] GetProcessHeap () returned 0x560000 [0046.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0046.689] GetProcessHeap () returned 0x560000 [0046.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.689] GetProcessHeap () returned 0x560000 [0046.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.689] WriteFile (in: hFile=0x230, lpBuffer=0x58df10*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58df10*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0046.691] GetProcessHeap () returned 0x560000 [0046.691] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58df10, Size=0x30) returned 0x58df10 [0046.691] GetProcessHeap () returned 0x560000 [0046.691] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.691] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.691] GetProcessHeap () returned 0x560000 [0046.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15c60) returned 0x5a13b8 [0046.693] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x15c60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x15c60, lpOverlapped=0x0) returned 1 [0046.695] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.695] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x15c60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x15c60, lpOverlapped=0x0) returned 1 [0046.696] GetProcessHeap () returned 0x560000 [0046.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.696] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.696] WriteFile (in: hFile=0x230, lpBuffer=0x58df10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58df10*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.698] CloseHandle (hObject=0x230) returned 1 [0046.701] GetProcessHeap () returned 0x560000 [0046.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0046.701] GetProcessHeap () returned 0x560000 [0046.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.701] GetProcessHeap () returned 0x560000 [0046.701] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.701] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf" [0046.701] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf.badday" [0046.701] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\ws5fx-k ayxb.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\ws5fx-k ayxb.swf.badday"), dwFlags=0x1) returned 1 [0046.701] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\WS5fX-K AYxB.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X") returned 1 [0046.701] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\") returned="" [0046.701] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" [0046.702] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Dqz_0X9ePbor5mqd U_X\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\dqz_0x9epbor5mqd u_x\\how_to_back_files.html")) returned 0x20 [0046.702] GetProcessHeap () returned 0x560000 [0046.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576818 | out: hHeap=0x560000) returned 1 [0046.702] FindNextFileW (in: hFindFile=0x58d048, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabf61820, ftCreationTime.dwHighDateTime=0x1d4d493, ftLastAccessTime.dwLowDateTime=0x2c4fc330, ftLastAccessTime.dwHighDateTime=0x1d4cdb0, ftLastWriteTime.dwLowDateTime=0x2c4fc330, ftLastWriteTime.dwHighDateTime=0x1d4cdb0, nFileSizeHigh=0x0, nFileSizeLow=0x15c53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WS5fX-K AYxB.swf", cAlternateFileName="WS5FX-~1.SWF")) returned 0 [0046.702] FindClose (in: hFindFile=0x58d048 | out: hFindFile=0x58d048) returned 1 [0046.702] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\" [0046.702] GetProcessHeap () returned 0x560000 [0046.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572c80 | out: hHeap=0x560000) returned 1 [0046.702] GetProcessHeap () returned 0x560000 [0046.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.702] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned 28 [0046.702] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\*") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\*" [0046.702] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c9acb80, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x689807b0, ftLastAccessTime.dwHighDateTime=0x1d4cd62, ftLastWriteTime.dwLowDateTime=0x689807b0, ftLastWriteTime.dwHighDateTime=0x1d4cd62, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58d208 [0046.702] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.702] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c9acb80, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x689807b0, ftLastAccessTime.dwHighDateTime=0x1d4cd62, ftLastWriteTime.dwLowDateTime=0x689807b0, ftLastWriteTime.dwHighDateTime=0x1d4cd62, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.702] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.702] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.702] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b86d030, ftCreationTime.dwHighDateTime=0x1d4c818, ftLastAccessTime.dwLowDateTime=0xa57394a0, ftLastAccessTime.dwHighDateTime=0x1d4d27c, ftLastWriteTime.dwLowDateTime=0xa57394a0, ftLastWriteTime.dwHighDateTime=0x1d4d27c, nFileSizeHigh=0x0, nFileSizeLow=0x11dc1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1n7ETFVaYrgydl5gq.mkv", cAlternateFileName="1N7ETF~1.MKV")) returned 1 [0046.702] lstrcmpiW (lpString1="1n7ETFVaYrgydl5gq.mkv", lpString2=".") returned 1 [0046.702] lstrcmpiW (lpString1="1n7ETFVaYrgydl5gq.mkv", lpString2="..") returned 1 [0046.702] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="1n7ETFVaYrgydl5gq.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv" [0046.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1n7ETFVaYrgydl5gq.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0046.702] GetProcessHeap () returned 0x560000 [0046.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576878 [0046.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1n7ETFVaYrgydl5gq.mkv", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1n7ETFVaYrgydl5gq.mkv", lpUsedDefaultChar=0x0) returned 22 [0046.703] lstrlenA (lpString="1n7ETFVaYrgydl5gq.mkv") returned 21 [0046.703] lstrlenA (lpString=".badday") returned 7 [0046.703] lstrlenA (lpString=".badday") returned 7 [0046.703] lstrlenA (lpString="1n7ETFVaYrgydl5gq.mkv") returned 21 [0046.703] lstrcmpiA (lpString1="5gq.mkv", lpString2=".badday") returned 1 [0046.703] lstrcmpiW (lpString1="1n7ETFVaYrgydl5gq.mkv", lpString2="how_to_back_files.html") returned -1 [0046.703] lstrcmpiW (lpString1="1n7ETFVaYrgydl5gq.mkv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0046.703] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.703] lstrcmpiW (lpString1="1n7ETFVaYrgydl5gq.mkv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.703] GetProcessHeap () returned 0x560000 [0046.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0046.703] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\1n7etfvayrgydl5gq.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.703] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=73153) returned 1 [0046.703] GetProcessHeap () returned 0x560000 [0046.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.703] GetProcessHeap () returned 0x560000 [0046.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.703] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv") returned 49 [0046.703] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.703] GetProcessHeap () returned 0x560000 [0046.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.703] GetProcessHeap () returned 0x560000 [0046.703] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x58df48 [0046.703] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.703] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.704] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.704] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.704] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.704] GetProcessHeap () returned 0x560000 [0046.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.704] lstrlenA (lpString="010001") returned 6 [0046.704] GetProcessHeap () returned 0x560000 [0046.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a358 [0046.704] GetProcessHeap () returned 0x560000 [0046.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.704] GetProcessHeap () returned 0x560000 [0046.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfb8 [0046.704] GetProcessHeap () returned 0x560000 [0046.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.704] GetProcessHeap () returned 0x560000 [0046.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0046.704] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a328 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c08 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.705] GetProcessHeap () returned 0x560000 [0046.705] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bb38 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c08 | out: hHeap=0x560000) returned 1 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bb38 | out: hHeap=0x560000) returned 1 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.706] GetProcessHeap () returned 0x560000 [0046.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.707] GetProcessHeap () returned 0x560000 [0046.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.708] GetProcessHeap () returned 0x560000 [0046.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.708] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.709] GetProcessHeap () returned 0x560000 [0046.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.709] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.710] GetProcessHeap () returned 0x560000 [0046.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfb8 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.711] GetProcessHeap () returned 0x560000 [0046.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.712] WriteFile (in: hFile=0x230, lpBuffer=0x58df48*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58df48*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0046.717] GetProcessHeap () returned 0x560000 [0046.717] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58df48, Size=0x30) returned 0x58df48 [0046.717] GetProcessHeap () returned 0x560000 [0046.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.717] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.717] GetProcessHeap () returned 0x560000 [0046.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11dd0) returned 0x5a13b8 [0046.717] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x11dd0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x11dd0, lpOverlapped=0x0) returned 1 [0046.719] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.719] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x11dd0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x11dd0, lpOverlapped=0x0) returned 1 [0046.720] GetProcessHeap () returned 0x560000 [0046.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.722] WriteFile (in: hFile=0x230, lpBuffer=0x58df48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58df48*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.723] CloseHandle (hObject=0x230) returned 1 [0046.725] GetProcessHeap () returned 0x560000 [0046.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0046.725] GetProcessHeap () returned 0x560000 [0046.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.725] GetProcessHeap () returned 0x560000 [0046.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.725] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv" [0046.725] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv.badday" [0046.725] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\1n7etfvayrgydl5gq.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\1n7etfvayrgydl5gq.mkv.badday"), dwFlags=0x1) returned 1 [0046.726] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\1n7ETFVaYrgydl5gq.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.726] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.726] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.726] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0xffffffff [0046.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0046.726] GetProcessHeap () returned 0x560000 [0046.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.726] GetProcessHeap () returned 0x560000 [0046.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.744] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.747] GetProcessHeap () returned 0x560000 [0046.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.747] GetProcessHeap () returned 0x560000 [0046.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.747] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0046.747] GetProcessHeap () returned 0x560000 [0046.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.747] GetProcessHeap () returned 0x560000 [0046.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.761] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.768] GetProcessHeap () returned 0x560000 [0046.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.768] GetProcessHeap () returned 0x560000 [0046.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.768] CloseHandle (hObject=0x230) returned 1 [0046.768] GetProcessHeap () returned 0x560000 [0046.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0046.768] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x894fa0a0, ftCreationTime.dwHighDateTime=0x1d4cb7b, ftLastAccessTime.dwLowDateTime=0xd18d7f10, ftLastAccessTime.dwHighDateTime=0x1d4d4d9, ftLastWriteTime.dwLowDateTime=0xd18d7f10, ftLastWriteTime.dwHighDateTime=0x1d4d4d9, nFileSizeHigh=0x0, nFileSizeLow=0xadac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Lij0gKo9eRZq3H17Jo.avi", cAlternateFileName="6LIJ0G~1.AVI")) returned 1 [0046.768] lstrcmpiW (lpString1="6Lij0gKo9eRZq3H17Jo.avi", lpString2=".") returned 1 [0046.768] lstrcmpiW (lpString1="6Lij0gKo9eRZq3H17Jo.avi", lpString2="..") returned 1 [0046.768] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="6Lij0gKo9eRZq3H17Jo.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi" [0046.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6Lij0gKo9eRZq3H17Jo.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0046.768] GetProcessHeap () returned 0x560000 [0046.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576b58 [0046.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6Lij0gKo9eRZq3H17Jo.avi", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6Lij0gKo9eRZq3H17Jo.avi", lpUsedDefaultChar=0x0) returned 24 [0046.768] lstrlenA (lpString="6Lij0gKo9eRZq3H17Jo.avi") returned 23 [0046.768] lstrlenA (lpString=".badday") returned 7 [0046.768] lstrlenA (lpString=".badday") returned 7 [0046.769] lstrlenA (lpString="6Lij0gKo9eRZq3H17Jo.avi") returned 23 [0046.769] lstrcmpiA (lpString1="7Jo.avi", lpString2=".badday") returned 1 [0046.769] lstrcmpiW (lpString1="6Lij0gKo9eRZq3H17Jo.avi", lpString2="how_to_back_files.html") returned -1 [0046.769] lstrcmpiW (lpString1="6Lij0gKo9eRZq3H17Jo.avi", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0046.769] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.769] lstrcmpiW (lpString1="6Lij0gKo9eRZq3H17Jo.avi", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.769] GetProcessHeap () returned 0x560000 [0046.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d328 [0046.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\6lij0gko9erzq3h17jo.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.769] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=44460) returned 1 [0046.769] GetProcessHeap () returned 0x560000 [0046.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.769] GetProcessHeap () returned 0x560000 [0046.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.769] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi") returned 51 [0046.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.769] GetProcessHeap () returned 0x560000 [0046.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.769] GetProcessHeap () returned 0x560000 [0046.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58df80 [0046.770] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.770] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.770] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.770] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.770] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.770] GetProcessHeap () returned 0x560000 [0046.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.770] lstrlenA (lpString="010001") returned 6 [0046.770] GetProcessHeap () returned 0x560000 [0046.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a228 [0046.770] GetProcessHeap () returned 0x560000 [0046.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.770] GetProcessHeap () returned 0x560000 [0046.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c288 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bd78 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.771] GetProcessHeap () returned 0x560000 [0046.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d70 [0046.771] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c828 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d70 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c828 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.772] GetProcessHeap () returned 0x560000 [0046.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.772] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.773] GetProcessHeap () returned 0x560000 [0046.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.774] GetProcessHeap () returned 0x560000 [0046.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.774] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.775] GetProcessHeap () returned 0x560000 [0046.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.775] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c288 | out: hHeap=0x560000) returned 1 [0046.776] GetProcessHeap () returned 0x560000 [0046.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.777] GetProcessHeap () returned 0x560000 [0046.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0046.777] GetProcessHeap () returned 0x560000 [0046.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.777] GetProcessHeap () returned 0x560000 [0046.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.777] GetProcessHeap () returned 0x560000 [0046.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.777] WriteFile (in: hFile=0x230, lpBuffer=0x58df80*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58df80*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.779] GetProcessHeap () returned 0x560000 [0046.779] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58df80, Size=0x30) returned 0x58df80 [0046.779] GetProcessHeap () returned 0x560000 [0046.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.779] GetProcessHeap () returned 0x560000 [0046.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xadac) returned 0x5a13b8 [0046.781] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0xadac, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0xadac, lpOverlapped=0x0) returned 1 [0046.782] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.782] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0xadac, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xadac, lpOverlapped=0x0) returned 1 [0046.783] GetProcessHeap () returned 0x560000 [0046.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.783] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.783] WriteFile (in: hFile=0x230, lpBuffer=0x58df80*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58df80*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.784] CloseHandle (hObject=0x230) returned 1 [0046.786] GetProcessHeap () returned 0x560000 [0046.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0046.786] GetProcessHeap () returned 0x560000 [0046.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.786] GetProcessHeap () returned 0x560000 [0046.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.786] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi" [0046.786] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi.badday" [0046.787] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\6lij0gko9erzq3h17jo.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\6lij0gko9erzq3h17jo.avi.badday"), dwFlags=0x1) returned 1 [0046.787] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\6Lij0gKo9eRZq3H17Jo.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.787] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.787] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.787] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0x20 [0046.787] GetProcessHeap () returned 0x560000 [0046.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0046.787] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb503b2f0, ftCreationTime.dwHighDateTime=0x1d4cc9c, ftLastAccessTime.dwLowDateTime=0x33a5b2c0, ftLastAccessTime.dwHighDateTime=0x1d4cd97, ftLastWriteTime.dwLowDateTime=0x33a5b2c0, ftLastWriteTime.dwHighDateTime=0x1d4cd97, nFileSizeHigh=0x0, nFileSizeLow=0x142e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AU-n-lqXxAjCSxxW55O.mp4", cAlternateFileName="AU-N-L~1.MP4")) returned 1 [0046.787] lstrcmpiW (lpString1="AU-n-lqXxAjCSxxW55O.mp4", lpString2=".") returned 1 [0046.787] lstrcmpiW (lpString1="AU-n-lqXxAjCSxxW55O.mp4", lpString2="..") returned 1 [0046.787] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="AU-n-lqXxAjCSxxW55O.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4" [0046.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AU-n-lqXxAjCSxxW55O.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0046.787] GetProcessHeap () returned 0x560000 [0046.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576878 [0046.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AU-n-lqXxAjCSxxW55O.mp4", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AU-n-lqXxAjCSxxW55O.mp4", lpUsedDefaultChar=0x0) returned 24 [0046.788] lstrlenA (lpString="AU-n-lqXxAjCSxxW55O.mp4") returned 23 [0046.788] lstrlenA (lpString=".badday") returned 7 [0046.788] lstrlenA (lpString=".badday") returned 7 [0046.788] lstrlenA (lpString="AU-n-lqXxAjCSxxW55O.mp4") returned 23 [0046.788] lstrcmpiA (lpString1="55O.mp4", lpString2=".badday") returned 1 [0046.788] lstrcmpiW (lpString1="AU-n-lqXxAjCSxxW55O.mp4", lpString2="how_to_back_files.html") returned -1 [0046.788] lstrcmpiW (lpString1="AU-n-lqXxAjCSxxW55O.mp4", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.788] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.788] lstrcmpiW (lpString1="AU-n-lqXxAjCSxxW55O.mp4", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.788] GetProcessHeap () returned 0x560000 [0046.788] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0046.788] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\au-n-lqxxajcsxxw55o.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.788] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=82659) returned 1 [0046.788] GetProcessHeap () returned 0x560000 [0046.788] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.788] GetProcessHeap () returned 0x560000 [0046.788] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.788] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4") returned 51 [0046.788] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.788] GetProcessHeap () returned 0x560000 [0046.788] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.788] GetProcessHeap () returned 0x560000 [0046.788] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58dfb8 [0046.788] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.788] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.789] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.789] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.789] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.789] GetProcessHeap () returned 0x560000 [0046.789] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.789] lstrlenA (lpString="010001") returned 6 [0046.789] GetProcessHeap () returned 0x560000 [0046.789] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a248 [0046.789] GetProcessHeap () returned 0x560000 [0046.789] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.789] GetProcessHeap () returned 0x560000 [0046.789] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0046.789] GetProcessHeap () returned 0x560000 [0046.789] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.789] GetProcessHeap () returned 0x560000 [0046.789] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0046.789] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a238 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bd78 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ef0 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.790] GetProcessHeap () returned 0x560000 [0046.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.790] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bc58 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ef0 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.791] GetProcessHeap () returned 0x560000 [0046.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.792] GetProcessHeap () returned 0x560000 [0046.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.793] GetProcessHeap () returned 0x560000 [0046.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.794] GetProcessHeap () returned 0x560000 [0046.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0046.795] GetProcessHeap () returned 0x560000 [0046.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.796] GetProcessHeap () returned 0x560000 [0046.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0046.796] GetProcessHeap () returned 0x560000 [0046.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0046.796] GetProcessHeap () returned 0x560000 [0046.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.796] GetProcessHeap () returned 0x560000 [0046.796] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.796] WriteFile (in: hFile=0x230, lpBuffer=0x58dfb8*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dfb8*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0046.797] GetProcessHeap () returned 0x560000 [0046.797] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dfb8, Size=0x30) returned 0x58dfb8 [0046.797] GetProcessHeap () returned 0x560000 [0046.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.797] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.797] GetProcessHeap () returned 0x560000 [0046.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x142f0) returned 0x5a13b8 [0046.798] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x142f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x142f0, lpOverlapped=0x0) returned 1 [0046.799] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.799] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x142f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x142f0, lpOverlapped=0x0) returned 1 [0046.801] GetProcessHeap () returned 0x560000 [0046.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.802] WriteFile (in: hFile=0x230, lpBuffer=0x58dfb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dfb8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.803] CloseHandle (hObject=0x230) returned 1 [0046.806] GetProcessHeap () returned 0x560000 [0046.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0046.806] GetProcessHeap () returned 0x560000 [0046.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.806] GetProcessHeap () returned 0x560000 [0046.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.806] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4" [0046.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4.badday" [0046.806] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\au-n-lqxxajcsxxw55o.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\au-n-lqxxajcsxxw55o.mp4.badday"), dwFlags=0x1) returned 1 [0046.806] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\AU-n-lqXxAjCSxxW55O.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.806] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.806] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0x20 [0046.806] GetProcessHeap () returned 0x560000 [0046.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0046.807] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19795bf0, ftCreationTime.dwHighDateTime=0x1d4d52f, ftLastAccessTime.dwLowDateTime=0xb69cf840, ftLastAccessTime.dwHighDateTime=0x1d4d289, ftLastWriteTime.dwLowDateTime=0xb69cf840, ftLastWriteTime.dwHighDateTime=0x1d4d289, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F-0VzNSZc2or1F", cAlternateFileName="F-0VZN~1")) returned 1 [0046.807] lstrcmpiW (lpString1="F-0VzNSZc2or1F", lpString2=".") returned 1 [0046.807] lstrcmpiW (lpString1="F-0VzNSZc2or1F", lpString2="..") returned 1 [0046.807] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="F-0VzNSZc2or1F" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F" [0046.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="F-0VzNSZc2or1F", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.807] GetProcessHeap () returned 0x560000 [0046.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0046.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="F-0VzNSZc2or1F", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F-0VzNSZc2or1F", lpUsedDefaultChar=0x0) returned 15 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0046.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="F-0VzNSZc2or1F", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0046.808] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\" [0046.808] GetProcessHeap () returned 0x560000 [0046.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a298 [0046.808] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned 43 [0046.808] GetProcessHeap () returned 0x560000 [0046.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x58) returned 0x58b630 [0046.808] lstrcpyW (in: lpString1=0x58b630, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\" [0046.808] GetProcessHeap () returned 0x560000 [0046.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.808] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1721bf90, ftCreationTime.dwHighDateTime=0x1d4cf09, ftLastAccessTime.dwLowDateTime=0x16bce370, ftLastAccessTime.dwHighDateTime=0x1d4ca4c, ftLastWriteTime.dwLowDateTime=0x16bce370, ftLastWriteTime.dwHighDateTime=0x1d4ca4c, nFileSizeHigh=0x0, nFileSizeLow=0x1f73, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gzdBvh.flv", cAlternateFileName="")) returned 1 [0046.809] lstrcmpiW (lpString1="gzdBvh.flv", lpString2=".") returned 1 [0046.809] lstrcmpiW (lpString1="gzdBvh.flv", lpString2="..") returned 1 [0046.809] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="gzdBvh.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv" [0046.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gzdBvh.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.809] GetProcessHeap () returned 0x560000 [0046.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0046.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gzdBvh.flv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gzdBvh.flv", lpUsedDefaultChar=0x0) returned 11 [0046.809] lstrlenA (lpString="gzdBvh.flv") returned 10 [0046.809] lstrlenA (lpString=".badday") returned 7 [0046.809] lstrlenA (lpString=".badday") returned 7 [0046.809] lstrlenA (lpString="gzdBvh.flv") returned 10 [0046.809] lstrcmpiA (lpString1="Bvh.flv", lpString2=".badday") returned 1 [0046.809] lstrcmpiW (lpString1="gzdBvh.flv", lpString2="how_to_back_files.html") returned -1 [0046.809] lstrcmpiW (lpString1="gzdBvh.flv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.809] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.809] lstrcmpiW (lpString1="gzdBvh.flv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.809] GetProcessHeap () returned 0x560000 [0046.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1e8 [0046.809] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\gzdbvh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.809] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=8051) returned 1 [0046.809] GetProcessHeap () returned 0x560000 [0046.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.809] GetProcessHeap () returned 0x560000 [0046.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.809] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv") returned 38 [0046.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.809] GetProcessHeap () returned 0x560000 [0046.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.810] GetProcessHeap () returned 0x560000 [0046.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58dff0 [0046.810] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.810] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.810] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.810] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.810] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.810] GetProcessHeap () returned 0x560000 [0046.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.810] lstrlenA (lpString="010001") returned 6 [0046.810] GetProcessHeap () returned 0x560000 [0046.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2d8 [0046.810] GetProcessHeap () returned 0x560000 [0046.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.810] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c048 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a378 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589de8 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c798 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c798 | out: hHeap=0x560000) returned 1 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.811] GetProcessHeap () returned 0x560000 [0046.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b90 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca68 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b90 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.812] GetProcessHeap () returned 0x560000 [0046.812] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.813] GetProcessHeap () returned 0x560000 [0046.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.813] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.814] GetProcessHeap () returned 0x560000 [0046.814] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.815] GetProcessHeap () returned 0x560000 [0046.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.815] GetProcessHeap () returned 0x560000 [0046.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.816] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.835] GetProcessHeap () returned 0x560000 [0046.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589de8 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c048 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.836] GetProcessHeap () returned 0x560000 [0046.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.836] WriteFile (in: hFile=0x230, lpBuffer=0x58dff0*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dff0*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0046.838] GetProcessHeap () returned 0x560000 [0046.838] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58dff0, Size=0x30) returned 0x58dff0 [0046.838] GetProcessHeap () returned 0x560000 [0046.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.838] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.839] GetProcessHeap () returned 0x560000 [0046.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1f80) returned 0x5a13b8 [0046.840] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x1f80, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x1f80, lpOverlapped=0x0) returned 1 [0046.840] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.840] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x1f80, lpOverlapped=0x0) returned 1 [0046.842] GetProcessHeap () returned 0x560000 [0046.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.842] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.842] WriteFile (in: hFile=0x230, lpBuffer=0x58dff0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58dff0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.844] CloseHandle (hObject=0x230) returned 1 [0046.845] GetProcessHeap () returned 0x560000 [0046.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1e8 | out: hHeap=0x560000) returned 1 [0046.845] GetProcessHeap () returned 0x560000 [0046.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.845] GetProcessHeap () returned 0x560000 [0046.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.845] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv" [0046.845] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv.badday" [0046.845] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\gzdbvh.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\gzdbvh.flv.badday"), dwFlags=0x1) returned 1 [0046.846] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\gzdBvh.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.846] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.846] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0x20 [0046.846] GetProcessHeap () returned 0x560000 [0046.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.846] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45acb790, ftCreationTime.dwHighDateTime=0x1d4c782, ftLastAccessTime.dwLowDateTime=0xef4ac1a0, ftLastAccessTime.dwHighDateTime=0x1d4cacc, ftLastWriteTime.dwLowDateTime=0xef4ac1a0, ftLastWriteTime.dwHighDateTime=0x1d4cacc, nFileSizeHigh=0x0, nFileSizeLow=0x726a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ik1BV8EWWpDx_je.swf", cAlternateFileName="IK1BV8~1.SWF")) returned 1 [0046.846] lstrcmpiW (lpString1="Ik1BV8EWWpDx_je.swf", lpString2=".") returned 1 [0046.846] lstrcmpiW (lpString1="Ik1BV8EWWpDx_je.swf", lpString2="..") returned 1 [0046.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="Ik1BV8EWWpDx_je.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf" [0046.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ik1BV8EWWpDx_je.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.846] GetProcessHeap () returned 0x560000 [0046.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576898 [0046.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ik1BV8EWWpDx_je.swf", cchWideChar=-1, lpMultiByteStr=0x576898, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ik1BV8EWWpDx_je.swf", lpUsedDefaultChar=0x0) returned 20 [0046.846] lstrlenA (lpString="Ik1BV8EWWpDx_je.swf") returned 19 [0046.846] lstrlenA (lpString=".badday") returned 7 [0046.846] lstrlenA (lpString=".badday") returned 7 [0046.846] lstrlenA (lpString="Ik1BV8EWWpDx_je.swf") returned 19 [0046.846] lstrcmpiA (lpString1="_je.swf", lpString2=".badday") returned 1 [0046.846] lstrcmpiW (lpString1="Ik1BV8EWWpDx_je.swf", lpString2="how_to_back_files.html") returned 1 [0046.846] lstrcmpiW (lpString1="Ik1BV8EWWpDx_je.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.846] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.846] lstrcmpiW (lpString1="Ik1BV8EWWpDx_je.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.846] GetProcessHeap () returned 0x560000 [0046.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0046.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\ik1bv8ewwpdx_je.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.847] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=29290) returned 1 [0046.847] GetProcessHeap () returned 0x560000 [0046.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.847] GetProcessHeap () returned 0x560000 [0046.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.847] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf") returned 47 [0046.847] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.847] GetProcessHeap () returned 0x560000 [0046.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.847] GetProcessHeap () returned 0x560000 [0046.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e028 [0046.847] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.847] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.848] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.848] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.848] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.848] lstrlenA (lpString="010001") returned 6 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a258 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf28 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c9d8 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0046.848] GetProcessHeap () returned 0x560000 [0046.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a358 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d88 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c5e8 [0046.849] GetProcessHeap () returned 0x560000 [0046.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d88 | out: hHeap=0x560000) returned 1 [0046.849] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.850] GetProcessHeap () returned 0x560000 [0046.850] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.850] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.851] GetProcessHeap () returned 0x560000 [0046.851] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.851] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.852] GetProcessHeap () returned 0x560000 [0046.852] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.852] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.853] GetProcessHeap () returned 0x560000 [0046.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c9d8 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.854] GetProcessHeap () returned 0x560000 [0046.855] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.855] WriteFile (in: hFile=0x230, lpBuffer=0x58e028*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e028*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.856] GetProcessHeap () returned 0x560000 [0046.856] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e028, Size=0x30) returned 0x58e028 [0046.856] GetProcessHeap () returned 0x560000 [0046.856] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.856] GetProcessHeap () returned 0x560000 [0046.856] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x726a) returned 0x5a13b8 [0046.857] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x726a, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x726a, lpOverlapped=0x0) returned 1 [0046.857] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.857] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x726a, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x726a, lpOverlapped=0x0) returned 1 [0046.858] GetProcessHeap () returned 0x560000 [0046.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.860] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.860] WriteFile (in: hFile=0x230, lpBuffer=0x58e028*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e028*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.861] CloseHandle (hObject=0x230) returned 1 [0046.862] GetProcessHeap () returned 0x560000 [0046.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0046.863] GetProcessHeap () returned 0x560000 [0046.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.863] GetProcessHeap () returned 0x560000 [0046.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.863] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf" [0046.863] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf.badday" [0046.863] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\ik1bv8ewwpdx_je.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\ik1bv8ewwpdx_je.swf.badday"), dwFlags=0x1) returned 1 [0046.863] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\Ik1BV8EWWpDx_je.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.863] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.863] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.863] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0x20 [0046.863] GetProcessHeap () returned 0x560000 [0046.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576898 | out: hHeap=0x560000) returned 1 [0046.863] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35549dc0, ftCreationTime.dwHighDateTime=0x1d4ceb4, ftLastAccessTime.dwLowDateTime=0x2bdb920, ftLastAccessTime.dwHighDateTime=0x1d4cde5, ftLastWriteTime.dwLowDateTime=0x2bdb920, ftLastWriteTime.dwHighDateTime=0x1d4cde5, nFileSizeHigh=0x0, nFileSizeLow=0x12745, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kLWn3V1nfw.flv", cAlternateFileName="KLWN3V~1.FLV")) returned 1 [0046.863] lstrcmpiW (lpString1="kLWn3V1nfw.flv", lpString2=".") returned 1 [0046.863] lstrcmpiW (lpString1="kLWn3V1nfw.flv", lpString2="..") returned 1 [0046.864] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="kLWn3V1nfw.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv" [0046.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kLWn3V1nfw.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.864] GetProcessHeap () returned 0x560000 [0046.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0046.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kLWn3V1nfw.flv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kLWn3V1nfw.flv", lpUsedDefaultChar=0x0) returned 15 [0046.864] lstrlenA (lpString="kLWn3V1nfw.flv") returned 14 [0046.864] lstrlenA (lpString=".badday") returned 7 [0046.864] lstrlenA (lpString=".badday") returned 7 [0046.864] lstrlenA (lpString="kLWn3V1nfw.flv") returned 14 [0046.864] lstrcmpiA (lpString1="nfw.flv", lpString2=".badday") returned 1 [0046.864] lstrcmpiW (lpString1="kLWn3V1nfw.flv", lpString2="how_to_back_files.html") returned 1 [0046.864] lstrcmpiW (lpString1="kLWn3V1nfw.flv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.864] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.864] lstrcmpiW (lpString1="kLWn3V1nfw.flv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.864] GetProcessHeap () returned 0x560000 [0046.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0046.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\klwn3v1nfw.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.864] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=75589) returned 1 [0046.864] GetProcessHeap () returned 0x560000 [0046.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.864] GetProcessHeap () returned 0x560000 [0046.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.864] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv") returned 42 [0046.864] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.864] GetProcessHeap () returned 0x560000 [0046.864] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.865] GetProcessHeap () returned 0x560000 [0046.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e060 [0046.865] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.865] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.865] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.865] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.865] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.865] GetProcessHeap () returned 0x560000 [0046.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.865] lstrlenA (lpString="010001") returned 6 [0046.865] GetProcessHeap () returned 0x560000 [0046.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a308 [0046.865] GetProcessHeap () returned 0x560000 [0046.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.865] GetProcessHeap () returned 0x560000 [0046.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf28 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c318 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a258 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cc8 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be98 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be98 | out: hHeap=0x560000) returned 1 [0046.866] GetProcessHeap () returned 0x560000 [0046.866] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.866] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c98 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c168 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c98 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.867] GetProcessHeap () returned 0x560000 [0046.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.868] GetProcessHeap () returned 0x560000 [0046.868] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.868] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.869] GetProcessHeap () returned 0x560000 [0046.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.870] GetProcessHeap () returned 0x560000 [0046.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.871] GetProcessHeap () returned 0x560000 [0046.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cc8 | out: hHeap=0x560000) returned 1 [0046.872] GetProcessHeap () returned 0x560000 [0046.872] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c318 | out: hHeap=0x560000) returned 1 [0046.872] GetProcessHeap () returned 0x560000 [0046.872] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.872] GetProcessHeap () returned 0x560000 [0046.872] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0046.872] GetProcessHeap () returned 0x560000 [0046.872] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0046.872] GetProcessHeap () returned 0x560000 [0046.872] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.872] GetProcessHeap () returned 0x560000 [0046.872] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.872] WriteFile (in: hFile=0x230, lpBuffer=0x58e060*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e060*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.874] GetProcessHeap () returned 0x560000 [0046.874] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e060, Size=0x30) returned 0x58e060 [0046.874] GetProcessHeap () returned 0x560000 [0046.874] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.874] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.874] GetProcessHeap () returned 0x560000 [0046.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12745) returned 0x5a13b8 [0046.876] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x12745, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x12745, lpOverlapped=0x0) returned 1 [0046.877] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.877] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x12745, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x12745, lpOverlapped=0x0) returned 1 [0046.886] GetProcessHeap () returned 0x560000 [0046.886] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.886] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.886] WriteFile (in: hFile=0x230, lpBuffer=0x58e060*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e060*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.887] CloseHandle (hObject=0x230) returned 1 [0046.889] GetProcessHeap () returned 0x560000 [0046.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0046.889] GetProcessHeap () returned 0x560000 [0046.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.890] GetProcessHeap () returned 0x560000 [0046.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.890] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv" [0046.890] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv.badday" [0046.890] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\klwn3v1nfw.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\klwn3v1nfw.flv.badday"), dwFlags=0x1) returned 1 [0046.890] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\kLWn3V1nfw.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.890] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.890] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.890] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0x20 [0046.890] GetProcessHeap () returned 0x560000 [0046.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.890] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d6c840, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x86700bf0, ftLastAccessTime.dwHighDateTime=0x1d4caad, ftLastWriteTime.dwLowDateTime=0x86700bf0, ftLastWriteTime.dwHighDateTime=0x1d4caad, nFileSizeHigh=0x0, nFileSizeLow=0x2479, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QHejrY3S3.avi", cAlternateFileName="QHEJRY~1.AVI")) returned 1 [0046.890] lstrcmpiW (lpString1="QHejrY3S3.avi", lpString2=".") returned 1 [0046.890] lstrcmpiW (lpString1="QHejrY3S3.avi", lpString2="..") returned 1 [0046.890] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="QHejrY3S3.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi" [0046.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QHejrY3S3.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0046.891] GetProcessHeap () returned 0x560000 [0046.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0046.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QHejrY3S3.avi", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QHejrY3S3.avi", lpUsedDefaultChar=0x0) returned 14 [0046.891] lstrlenA (lpString="QHejrY3S3.avi") returned 13 [0046.891] lstrlenA (lpString=".badday") returned 7 [0046.891] lstrlenA (lpString=".badday") returned 7 [0046.891] lstrlenA (lpString="QHejrY3S3.avi") returned 13 [0046.891] lstrcmpiA (lpString1="3S3.avi", lpString2=".badday") returned 1 [0046.891] lstrcmpiW (lpString1="QHejrY3S3.avi", lpString2="how_to_back_files.html") returned 1 [0046.891] lstrcmpiW (lpString1="QHejrY3S3.avi", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0046.891] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.891] lstrcmpiW (lpString1="QHejrY3S3.avi", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0046.891] GetProcessHeap () returned 0x560000 [0046.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0046.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\qhejry3s3.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.891] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=9337) returned 1 [0046.891] GetProcessHeap () returned 0x560000 [0046.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.891] GetProcessHeap () returned 0x560000 [0046.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.891] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi") returned 41 [0046.891] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.891] GetProcessHeap () returned 0x560000 [0046.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.891] GetProcessHeap () returned 0x560000 [0046.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e098 [0046.891] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.892] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.892] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.892] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.892] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.892] GetProcessHeap () returned 0x560000 [0046.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.892] lstrlenA (lpString="010001") returned 6 [0046.892] GetProcessHeap () returned 0x560000 [0046.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1e8 [0046.892] GetProcessHeap () returned 0x560000 [0046.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.892] GetProcessHeap () returned 0x560000 [0046.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0046.892] GetProcessHeap () returned 0x560000 [0046.892] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.892] GetProcessHeap () returned 0x560000 [0046.892] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8b8 [0046.892] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a278 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e60 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca68 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e90 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.893] GetProcessHeap () returned 0x560000 [0046.893] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca68 [0046.893] GetProcessHeap () returned 0x560000 [0046.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e90 | out: hHeap=0x560000) returned 1 [0046.894] GetProcessHeap () returned 0x560000 [0046.894] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0046.894] GetProcessHeap () returned 0x560000 [0046.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca68 | out: hHeap=0x560000) returned 1 [0046.926] GetProcessHeap () returned 0x560000 [0046.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.926] GetProcessHeap () returned 0x560000 [0046.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.926] GetProcessHeap () returned 0x560000 [0046.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.926] GetProcessHeap () returned 0x560000 [0046.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.926] GetProcessHeap () returned 0x560000 [0046.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.926] GetProcessHeap () returned 0x560000 [0046.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.927] GetProcessHeap () returned 0x560000 [0046.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.928] GetProcessHeap () returned 0x560000 [0046.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.929] GetProcessHeap () returned 0x560000 [0046.929] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0046.930] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e60 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8b8 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.931] GetProcessHeap () returned 0x560000 [0046.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.931] WriteFile (in: hFile=0x230, lpBuffer=0x58e098*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e098*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.933] GetProcessHeap () returned 0x560000 [0046.933] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e098, Size=0x30) returned 0x58e098 [0046.933] GetProcessHeap () returned 0x560000 [0046.933] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.933] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.933] GetProcessHeap () returned 0x560000 [0046.933] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2479) returned 0x5a13b8 [0046.933] ReadFile (in: hFile=0x230, lpBuffer=0x5a13b8, nNumberOfBytesToRead=0x2479, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesRead=0x24ad7e8*=0x2479, lpOverlapped=0x0) returned 1 [0046.933] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.933] WriteFile (in: hFile=0x230, lpBuffer=0x5a13b8*, nNumberOfBytesToWrite=0x2479, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a13b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x2479, lpOverlapped=0x0) returned 1 [0046.934] GetProcessHeap () returned 0x560000 [0046.934] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a13b8 | out: hHeap=0x560000) returned 1 [0046.934] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.934] WriteFile (in: hFile=0x230, lpBuffer=0x58e098*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e098*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.935] CloseHandle (hObject=0x230) returned 1 [0046.936] GetProcessHeap () returned 0x560000 [0046.936] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0046.936] GetProcessHeap () returned 0x560000 [0046.936] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.936] GetProcessHeap () returned 0x560000 [0046.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.937] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi" [0046.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi.badday" [0046.937] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\qhejry3s3.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\qhejry3s3.avi.badday"), dwFlags=0x1) returned 1 [0046.937] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\QHejrY3S3.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O") returned 1 [0046.937] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\") returned="" [0046.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" [0046.937] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\how_to_back_files.html")) returned 0x20 [0046.937] GetProcessHeap () returned 0x560000 [0046.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0046.937] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90878c80, ftCreationTime.dwHighDateTime=0x1d4d1e7, ftLastAccessTime.dwLowDateTime=0x2ee5a310, ftLastAccessTime.dwHighDateTime=0x1d4d14f, ftLastWriteTime.dwLowDateTime=0x2ee5a310, ftLastWriteTime.dwHighDateTime=0x1d4d14f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R0WRBw", cAlternateFileName="")) returned 1 [0046.937] lstrcmpiW (lpString1="R0WRBw", lpString2=".") returned 1 [0046.937] lstrcmpiW (lpString1="R0WRBw", lpString2="..") returned 1 [0046.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\", lpString2="R0WRBw" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw" [0046.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R0WRBw", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.938] GetProcessHeap () returned 0x560000 [0046.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a2b8 [0046.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R0WRBw", cchWideChar=-1, lpMultiByteStr=0x58a2b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="R0WRBw", lpUsedDefaultChar=0x0) returned 7 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0046.938] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0046.939] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="R0WRBw", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0046.939] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\" [0046.939] GetProcessHeap () returned 0x560000 [0046.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a388 [0046.939] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned 35 [0046.939] GetProcessHeap () returned 0x560000 [0046.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x48) returned 0x585730 [0046.939] lstrcpyW (in: lpString1=0x585730, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\" [0046.939] GetProcessHeap () returned 0x560000 [0046.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.939] FindNextFileW (in: hFindFile=0x58d208, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90878c80, ftCreationTime.dwHighDateTime=0x1d4d1e7, ftLastAccessTime.dwLowDateTime=0x2ee5a310, ftLastAccessTime.dwHighDateTime=0x1d4d14f, ftLastWriteTime.dwLowDateTime=0x2ee5a310, ftLastWriteTime.dwHighDateTime=0x1d4d14f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R0WRBw", cAlternateFileName="")) returned 0 [0046.939] FindClose (in: hFindFile=0x58d208 | out: hFindFile=0x58d208) returned 1 [0046.939] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\" [0046.939] GetProcessHeap () returned 0x560000 [0046.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585730 | out: hHeap=0x560000) returned 1 [0046.940] GetProcessHeap () returned 0x560000 [0046.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0046.940] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned 35 [0046.940] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\*") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\*" [0046.940] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90878c80, ftCreationTime.dwHighDateTime=0x1d4d1e7, ftLastAccessTime.dwLowDateTime=0x2ee5a310, ftLastAccessTime.dwHighDateTime=0x1d4d14f, ftLastWriteTime.dwLowDateTime=0x2ee5a310, ftLastWriteTime.dwHighDateTime=0x1d4d14f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58cd88 [0046.940] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.940] FindNextFileW (in: hFindFile=0x58cd88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90878c80, ftCreationTime.dwHighDateTime=0x1d4d1e7, ftLastAccessTime.dwLowDateTime=0x2ee5a310, ftLastAccessTime.dwHighDateTime=0x1d4d14f, ftLastWriteTime.dwLowDateTime=0x2ee5a310, ftLastWriteTime.dwHighDateTime=0x1d4d14f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.940] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.940] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.940] FindNextFileW (in: hFindFile=0x58cd88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc7ee70, ftCreationTime.dwHighDateTime=0x1d4d115, ftLastAccessTime.dwLowDateTime=0xb2463f80, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0xb2463f80, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8g75R.mkv", cAlternateFileName="")) returned 1 [0046.940] lstrcmpiW (lpString1="8g75R.mkv", lpString2=".") returned 1 [0046.940] lstrcmpiW (lpString1="8g75R.mkv", lpString2="..") returned 1 [0046.940] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="8g75R.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv" [0046.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8g75R.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.940] GetProcessHeap () returned 0x560000 [0046.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0046.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8g75R.mkv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8g75R.mkv", lpUsedDefaultChar=0x0) returned 10 [0046.940] lstrlenA (lpString="8g75R.mkv") returned 9 [0046.940] lstrlenA (lpString=".badday") returned 7 [0046.940] lstrlenA (lpString=".badday") returned 7 [0046.940] lstrlenA (lpString="8g75R.mkv") returned 9 [0046.940] lstrcmpiA (lpString1="75R.mkv", lpString2=".badday") returned 1 [0046.940] lstrcmpiW (lpString1="8g75R.mkv", lpString2="how_to_back_files.html") returned -1 [0046.940] lstrcmpiW (lpString1="8g75R.mkv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0046.940] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0046.940] lstrcmpiW (lpString1="8g75R.mkv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0046.943] GetProcessHeap () returned 0x560000 [0046.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d328 [0046.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\8g75r.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0046.943] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=49504) returned 1 [0046.943] GetProcessHeap () returned 0x560000 [0046.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.943] GetProcessHeap () returned 0x560000 [0046.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.943] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv") returned 44 [0046.943] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.944] GetProcessHeap () returned 0x560000 [0046.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0046.944] GetProcessHeap () returned 0x560000 [0046.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e0d0 [0046.944] lstrlenA (lpString="rsa_encrypt") returned 11 [0046.944] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0046.944] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0046.944] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0046.944] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0046.944] GetProcessHeap () returned 0x560000 [0046.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0046.944] lstrlenA (lpString="010001") returned 6 [0046.944] GetProcessHeap () returned 0x560000 [0046.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a258 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c288 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c438 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a248 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d70 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf28 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0046.945] GetProcessHeap () returned 0x560000 [0046.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c4c8 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4c8 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0046.946] GetProcessHeap () returned 0x560000 [0046.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.947] GetProcessHeap () returned 0x560000 [0046.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.948] GetProcessHeap () returned 0x560000 [0046.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.948] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0046.949] GetProcessHeap () returned 0x560000 [0046.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0046.950] GetProcessHeap () returned 0x560000 [0046.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d70 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c438 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c288 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0046.951] GetProcessHeap () returned 0x560000 [0046.951] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0046.951] WriteFile (in: hFile=0x230, lpBuffer=0x58e0d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e0d0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0046.953] GetProcessHeap () returned 0x560000 [0046.953] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e0d0, Size=0x30) returned 0x58e0d0 [0046.953] GetProcessHeap () returned 0x560000 [0046.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0046.953] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.953] GetProcessHeap () returned 0x560000 [0046.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc160) returned 0x5a03b0 [0046.953] ReadFile (in: hFile=0x230, lpBuffer=0x5a03b0, nNumberOfBytesToRead=0xc160, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesRead=0x24ad7e8*=0xc160, lpOverlapped=0x0) returned 1 [0046.954] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0046.954] WriteFile (in: hFile=0x230, lpBuffer=0x5a03b0*, nNumberOfBytesToWrite=0xc160, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesWritten=0x24ad7e4*=0xc160, lpOverlapped=0x0) returned 1 [0046.955] GetProcessHeap () returned 0x560000 [0046.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a03b0 | out: hHeap=0x560000) returned 1 [0046.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0046.957] WriteFile (in: hFile=0x230, lpBuffer=0x58e0d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e0d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0046.958] CloseHandle (hObject=0x230) returned 1 [0046.960] GetProcessHeap () returned 0x560000 [0046.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0046.960] GetProcessHeap () returned 0x560000 [0046.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.960] GetProcessHeap () returned 0x560000 [0046.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.960] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv" [0046.960] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv.badday" [0046.960] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\8g75r.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\8g75r.mkv.badday"), dwFlags=0x1) returned 1 [0046.962] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\8g75R.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw") returned 1 [0046.962] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned="" [0046.962] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" [0046.962] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\how_to_back_files.html")) returned 0xffffffff [0046.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0046.962] GetProcessHeap () returned 0x560000 [0046.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.962] GetProcessHeap () returned 0x560000 [0046.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.969] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.970] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.972] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.974] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.975] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.976] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.978] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.979] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.980] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.981] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.982] GetProcessHeap () returned 0x560000 [0046.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0046.982] GetProcessHeap () returned 0x560000 [0046.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0046.982] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0046.982] GetProcessHeap () returned 0x560000 [0046.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0046.982] GetProcessHeap () returned 0x560000 [0046.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0046.989] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.990] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.992] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.993] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.994] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.995] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.997] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.004] GetProcessHeap () returned 0x560000 [0047.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.004] GetProcessHeap () returned 0x560000 [0047.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.004] CloseHandle (hObject=0x230) returned 1 [0047.005] GetProcessHeap () returned 0x560000 [0047.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.005] FindNextFileW (in: hFindFile=0x58cd88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22a4f60, ftCreationTime.dwHighDateTime=0x1d4cafc, ftLastAccessTime.dwLowDateTime=0xbad905d0, ftLastAccessTime.dwHighDateTime=0x1d4caea, ftLastWriteTime.dwLowDateTime=0xbad905d0, ftLastWriteTime.dwHighDateTime=0x1d4caea, nFileSizeHigh=0x0, nFileSizeLow=0x6f27, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MOHiOUFK2fv.mp4", cAlternateFileName="MOHIOU~1.MP4")) returned 1 [0047.005] lstrcmpiW (lpString1="MOHiOUFK2fv.mp4", lpString2=".") returned 1 [0047.005] lstrcmpiW (lpString1="MOHiOUFK2fv.mp4", lpString2="..") returned 1 [0047.005] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="MOHiOUFK2fv.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4" [0047.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MOHiOUFK2fv.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.005] GetProcessHeap () returned 0x560000 [0047.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0047.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MOHiOUFK2fv.mp4", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MOHiOUFK2fv.mp4", lpUsedDefaultChar=0x0) returned 16 [0047.005] lstrlenA (lpString="MOHiOUFK2fv.mp4") returned 15 [0047.005] lstrlenA (lpString=".badday") returned 7 [0047.005] lstrlenA (lpString=".badday") returned 7 [0047.005] lstrlenA (lpString="MOHiOUFK2fv.mp4") returned 15 [0047.005] lstrcmpiA (lpString1="2fv.mp4", lpString2=".badday") returned 1 [0047.005] lstrcmpiW (lpString1="MOHiOUFK2fv.mp4", lpString2="how_to_back_files.html") returned 1 [0047.005] lstrcmpiW (lpString1="MOHiOUFK2fv.mp4", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.005] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.005] lstrcmpiW (lpString1="MOHiOUFK2fv.mp4", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.005] GetProcessHeap () returned 0x560000 [0047.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0047.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\mohioufk2fv.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.005] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=28455) returned 1 [0047.006] GetProcessHeap () returned 0x560000 [0047.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.006] GetProcessHeap () returned 0x560000 [0047.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.006] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4") returned 50 [0047.006] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.006] GetProcessHeap () returned 0x560000 [0047.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.006] GetProcessHeap () returned 0x560000 [0047.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e108 [0047.006] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.006] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.006] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.006] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.006] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.007] lstrlenA (lpString="010001") returned 6 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1d8 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bce8 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a368 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ef0 [0047.007] GetProcessHeap () returned 0x560000 [0047.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c798 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c798 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e48 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bf28 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e48 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.008] GetProcessHeap () returned 0x560000 [0047.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.009] GetProcessHeap () returned 0x560000 [0047.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.010] GetProcessHeap () returned 0x560000 [0047.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.011] GetProcessHeap () returned 0x560000 [0047.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.011] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.012] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ef0 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bce8 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.013] GetProcessHeap () returned 0x560000 [0047.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.013] WriteFile (in: hFile=0x230, lpBuffer=0x58e108*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e108*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.020] GetProcessHeap () returned 0x560000 [0047.020] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e108, Size=0x30) returned 0x58e108 [0047.020] GetProcessHeap () returned 0x560000 [0047.020] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.020] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.020] GetProcessHeap () returned 0x560000 [0047.020] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6f27) returned 0x5a03b0 [0047.022] ReadFile (in: hFile=0x230, lpBuffer=0x5a03b0, nNumberOfBytesToRead=0x6f27, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesRead=0x24ad7e8*=0x6f27, lpOverlapped=0x0) returned 1 [0047.022] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.022] WriteFile (in: hFile=0x230, lpBuffer=0x5a03b0*, nNumberOfBytesToWrite=0x6f27, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x6f27, lpOverlapped=0x0) returned 1 [0047.024] GetProcessHeap () returned 0x560000 [0047.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a03b0 | out: hHeap=0x560000) returned 1 [0047.025] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.025] WriteFile (in: hFile=0x230, lpBuffer=0x58e108*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e108*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.026] CloseHandle (hObject=0x230) returned 1 [0047.028] GetProcessHeap () returned 0x560000 [0047.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0047.028] GetProcessHeap () returned 0x560000 [0047.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.028] GetProcessHeap () returned 0x560000 [0047.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.028] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4" [0047.028] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4.badday" [0047.028] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\mohioufk2fv.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\mohioufk2fv.mp4.badday"), dwFlags=0x1) returned 1 [0047.029] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\MOHiOUFK2fv.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw") returned 1 [0047.029] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned="" [0047.029] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" [0047.029] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\how_to_back_files.html")) returned 0x20 [0047.029] GetProcessHeap () returned 0x560000 [0047.029] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.029] FindNextFileW (in: hFindFile=0x58cd88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b65880, ftCreationTime.dwHighDateTime=0x1d4cb70, ftLastAccessTime.dwLowDateTime=0x8235bea0, ftLastAccessTime.dwHighDateTime=0x1d4caa2, ftLastWriteTime.dwLowDateTime=0x8235bea0, ftLastWriteTime.dwHighDateTime=0x1d4caa2, nFileSizeHigh=0x0, nFileSizeLow=0x5f25, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XrZk1x_KLWc3.avi", cAlternateFileName="XRZK1X~1.AVI")) returned 1 [0047.029] lstrcmpiW (lpString1="XrZk1x_KLWc3.avi", lpString2=".") returned 1 [0047.029] lstrcmpiW (lpString1="XrZk1x_KLWc3.avi", lpString2="..") returned 1 [0047.029] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="XrZk1x_KLWc3.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi" [0047.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XrZk1x_KLWc3.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.029] GetProcessHeap () returned 0x560000 [0047.029] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576b58 [0047.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XrZk1x_KLWc3.avi", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XrZk1x_KLWc3.avi", lpUsedDefaultChar=0x0) returned 17 [0047.029] lstrlenA (lpString="XrZk1x_KLWc3.avi") returned 16 [0047.029] lstrlenA (lpString=".badday") returned 7 [0047.029] lstrlenA (lpString=".badday") returned 7 [0047.029] lstrlenA (lpString="XrZk1x_KLWc3.avi") returned 16 [0047.029] lstrcmpiA (lpString1="Wc3.avi", lpString2=".badday") returned 1 [0047.030] lstrcmpiW (lpString1="XrZk1x_KLWc3.avi", lpString2="how_to_back_files.html") returned 1 [0047.030] lstrcmpiW (lpString1="XrZk1x_KLWc3.avi", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.030] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.030] lstrcmpiW (lpString1="XrZk1x_KLWc3.avi", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.030] GetProcessHeap () returned 0x560000 [0047.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0047.030] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\xrzk1x_klwc3.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.030] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=24357) returned 1 [0047.030] GetProcessHeap () returned 0x560000 [0047.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.030] GetProcessHeap () returned 0x560000 [0047.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.030] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi") returned 51 [0047.030] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.030] GetProcessHeap () returned 0x560000 [0047.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.030] GetProcessHeap () returned 0x560000 [0047.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x58e140 [0047.030] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.030] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.031] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.031] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.031] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.031] lstrlenA (lpString="010001") returned 6 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2f8 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c1f8 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c288 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a228 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0047.031] GetProcessHeap () returned 0x560000 [0047.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bd78 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ba8 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c708 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ba8 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.032] GetProcessHeap () returned 0x560000 [0047.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0047.032] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.033] GetProcessHeap () returned 0x560000 [0047.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.033] GetProcessHeap () returned 0x560000 [0047.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.034] GetProcessHeap () returned 0x560000 [0047.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.034] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.035] GetProcessHeap () returned 0x560000 [0047.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.036] GetProcessHeap () returned 0x560000 [0047.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.036] GetProcessHeap () returned 0x560000 [0047.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c288 | out: hHeap=0x560000) returned 1 [0047.037] GetProcessHeap () returned 0x560000 [0047.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.038] GetProcessHeap () returned 0x560000 [0047.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1f8 | out: hHeap=0x560000) returned 1 [0047.038] GetProcessHeap () returned 0x560000 [0047.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.038] GetProcessHeap () returned 0x560000 [0047.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.038] GetProcessHeap () returned 0x560000 [0047.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.038] WriteFile (in: hFile=0x230, lpBuffer=0x58e140*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e140*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0047.041] GetProcessHeap () returned 0x560000 [0047.041] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e140, Size=0x30) returned 0x58e140 [0047.041] GetProcessHeap () returned 0x560000 [0047.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.041] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.041] GetProcessHeap () returned 0x560000 [0047.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5f30) returned 0x5a03b0 [0047.042] ReadFile (in: hFile=0x230, lpBuffer=0x5a03b0, nNumberOfBytesToRead=0x5f30, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesRead=0x24ad7e8*=0x5f30, lpOverlapped=0x0) returned 1 [0047.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.043] WriteFile (in: hFile=0x230, lpBuffer=0x5a03b0*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x5f30, lpOverlapped=0x0) returned 1 [0047.050] GetProcessHeap () returned 0x560000 [0047.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a03b0 | out: hHeap=0x560000) returned 1 [0047.050] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.050] WriteFile (in: hFile=0x230, lpBuffer=0x58e140*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e140*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.051] CloseHandle (hObject=0x230) returned 1 [0047.052] GetProcessHeap () returned 0x560000 [0047.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0047.052] GetProcessHeap () returned 0x560000 [0047.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.052] GetProcessHeap () returned 0x560000 [0047.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.053] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi" [0047.053] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi.badday" [0047.053] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\xrzk1x_klwc3.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\xrzk1x_klwc3.avi.badday"), dwFlags=0x1) returned 1 [0047.053] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\XrZk1x_KLWc3.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw") returned 1 [0047.053] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\") returned="" [0047.053] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" [0047.053] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\R0WRBw\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\r0wrbw\\how_to_back_files.html")) returned 0x20 [0047.053] GetProcessHeap () returned 0x560000 [0047.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0047.053] FindNextFileW (in: hFindFile=0x58cd88, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b65880, ftCreationTime.dwHighDateTime=0x1d4cb70, ftLastAccessTime.dwLowDateTime=0x8235bea0, ftLastAccessTime.dwHighDateTime=0x1d4caa2, ftLastWriteTime.dwLowDateTime=0x8235bea0, ftLastWriteTime.dwHighDateTime=0x1d4caa2, nFileSizeHigh=0x0, nFileSizeLow=0x5f25, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XrZk1x_KLWc3.avi", cAlternateFileName="XRZK1X~1.AVI")) returned 0 [0047.053] FindClose (in: hFindFile=0x58cd88 | out: hFindFile=0x58cd88) returned 1 [0047.053] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\" [0047.054] GetProcessHeap () returned 0x560000 [0047.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b630 | out: hHeap=0x560000) returned 1 [0047.054] GetProcessHeap () returned 0x560000 [0047.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.054] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned 43 [0047.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\*") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\*" [0047.054] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19795bf0, ftCreationTime.dwHighDateTime=0x1d4d52f, ftLastAccessTime.dwLowDateTime=0xb69cf840, ftLastAccessTime.dwHighDateTime=0x1d4d289, ftLastWriteTime.dwLowDateTime=0xb69cf840, ftLastWriteTime.dwHighDateTime=0x1d4d289, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58ce08 [0047.054] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.054] FindNextFileW (in: hFindFile=0x58ce08, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19795bf0, ftCreationTime.dwHighDateTime=0x1d4d52f, ftLastAccessTime.dwLowDateTime=0xb69cf840, ftLastAccessTime.dwHighDateTime=0x1d4d289, ftLastWriteTime.dwLowDateTime=0xb69cf840, ftLastWriteTime.dwHighDateTime=0x1d4d289, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.054] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.054] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.054] FindNextFileW (in: hFindFile=0x58ce08, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab66400, ftCreationTime.dwHighDateTime=0x1d4ccfe, ftLastAccessTime.dwLowDateTime=0xb63c8350, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0xb63c8350, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0x3fc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-EmJ.swf", cAlternateFileName="")) returned 1 [0047.054] lstrcmpiW (lpString1="-EmJ.swf", lpString2=".") returned 1 [0047.054] lstrcmpiW (lpString1="-EmJ.swf", lpString2="..") returned 1 [0047.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="-EmJ.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf" [0047.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-EmJ.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.054] GetProcessHeap () returned 0x560000 [0047.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0047.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-EmJ.swf", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-EmJ.swf", lpUsedDefaultChar=0x0) returned 9 [0047.054] lstrlenA (lpString="-EmJ.swf") returned 8 [0047.054] lstrlenA (lpString=".badday") returned 7 [0047.054] lstrlenA (lpString=".badday") returned 7 [0047.054] lstrlenA (lpString="-EmJ.swf") returned 8 [0047.054] lstrcmpiA (lpString1="EmJ.swf", lpString2=".badday") returned 1 [0047.054] lstrcmpiW (lpString1="-EmJ.swf", lpString2="how_to_back_files.html") returned -1 [0047.054] lstrcmpiW (lpString1="-EmJ.swf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.054] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.054] lstrcmpiW (lpString1="-EmJ.swf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.055] GetProcessHeap () returned 0x560000 [0047.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0047.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\-emj.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.055] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=16320) returned 1 [0047.055] GetProcessHeap () returned 0x560000 [0047.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.055] GetProcessHeap () returned 0x560000 [0047.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.055] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf") returned 51 [0047.055] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.055] GetProcessHeap () returned 0x560000 [0047.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.055] GetProcessHeap () returned 0x560000 [0047.055] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e178 [0047.055] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.055] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.056] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.056] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.056] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.056] lstrlenA (lpString="010001") returned 6 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2f8 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3a8 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a308 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0047.056] GetProcessHeap () returned 0x560000 [0047.056] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.056] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c08 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d88 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c4c8 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d88 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4c8 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.057] GetProcessHeap () returned 0x560000 [0047.057] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.058] GetProcessHeap () returned 0x560000 [0047.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.059] GetProcessHeap () returned 0x560000 [0047.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.060] GetProcessHeap () returned 0x560000 [0047.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.060] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.061] GetProcessHeap () returned 0x560000 [0047.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c08 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.062] GetProcessHeap () returned 0x560000 [0047.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.062] WriteFile (in: hFile=0x230, lpBuffer=0x58e178*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e178*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.065] GetProcessHeap () returned 0x560000 [0047.065] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e178, Size=0x30) returned 0x58e178 [0047.065] GetProcessHeap () returned 0x560000 [0047.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.065] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.065] GetProcessHeap () returned 0x560000 [0047.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3fc0) returned 0x5a03b0 [0047.065] ReadFile (in: hFile=0x230, lpBuffer=0x5a03b0, nNumberOfBytesToRead=0x3fc0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesRead=0x24ad7e8*=0x3fc0, lpOverlapped=0x0) returned 1 [0047.065] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.065] WriteFile (in: hFile=0x230, lpBuffer=0x5a03b0*, nNumberOfBytesToWrite=0x3fc0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x3fc0, lpOverlapped=0x0) returned 1 [0047.066] GetProcessHeap () returned 0x560000 [0047.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a03b0 | out: hHeap=0x560000) returned 1 [0047.067] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.067] WriteFile (in: hFile=0x230, lpBuffer=0x58e178*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e178*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.067] CloseHandle (hObject=0x230) returned 1 [0047.069] GetProcessHeap () returned 0x560000 [0047.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0047.069] GetProcessHeap () returned 0x560000 [0047.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.069] GetProcessHeap () returned 0x560000 [0047.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.069] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf" [0047.069] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf.badday" [0047.069] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\-emj.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\-emj.swf.badday"), dwFlags=0x1) returned 1 [0047.070] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\-EmJ.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F") returned 1 [0047.070] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="" [0047.070] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" [0047.070] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\how_to_back_files.html")) returned 0xffffffff [0047.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0047.070] GetProcessHeap () returned 0x560000 [0047.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.070] GetProcessHeap () returned 0x560000 [0047.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.089] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.092] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.093] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.094] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.095] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.095] GetProcessHeap () returned 0x560000 [0047.095] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.095] GetProcessHeap () returned 0x560000 [0047.095] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.095] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0047.095] GetProcessHeap () returned 0x560000 [0047.095] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.095] GetProcessHeap () returned 0x560000 [0047.095] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.104] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.105] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.106] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.107] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.109] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.143] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.144] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.145] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.145] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.145] GetProcessHeap () returned 0x560000 [0047.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.145] GetProcessHeap () returned 0x560000 [0047.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.145] CloseHandle (hObject=0x230) returned 1 [0047.145] GetProcessHeap () returned 0x560000 [0047.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.145] FindNextFileW (in: hFindFile=0x58ce08, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28c4000, ftCreationTime.dwHighDateTime=0x1d4c71a, ftLastAccessTime.dwLowDateTime=0x4fdb1460, ftLastAccessTime.dwHighDateTime=0x1d4d091, ftLastWriteTime.dwLowDateTime=0x4fdb1460, ftLastWriteTime.dwHighDateTime=0x1d4d091, nFileSizeHigh=0x0, nFileSizeLow=0x16c64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rNZwc0utSRhX.mp4", cAlternateFileName="RNZWC0~1.MP4")) returned 1 [0047.145] lstrcmpiW (lpString1="rNZwc0utSRhX.mp4", lpString2=".") returned 1 [0047.145] lstrcmpiW (lpString1="rNZwc0utSRhX.mp4", lpString2="..") returned 1 [0047.146] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="rNZwc0utSRhX.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4" [0047.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rNZwc0utSRhX.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.146] GetProcessHeap () returned 0x560000 [0047.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576a58 [0047.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rNZwc0utSRhX.mp4", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rNZwc0utSRhX.mp4", lpUsedDefaultChar=0x0) returned 17 [0047.146] lstrlenA (lpString="rNZwc0utSRhX.mp4") returned 16 [0047.146] lstrlenA (lpString=".badday") returned 7 [0047.146] lstrlenA (lpString=".badday") returned 7 [0047.146] lstrlenA (lpString="rNZwc0utSRhX.mp4") returned 16 [0047.146] lstrcmpiA (lpString1="RhX.mp4", lpString2=".badday") returned 1 [0047.146] lstrcmpiW (lpString1="rNZwc0utSRhX.mp4", lpString2="how_to_back_files.html") returned 1 [0047.146] lstrcmpiW (lpString1="rNZwc0utSRhX.mp4", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.146] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.146] lstrcmpiW (lpString1="rNZwc0utSRhX.mp4", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.146] GetProcessHeap () returned 0x560000 [0047.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0047.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\rnzwc0utsrhx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.146] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=93284) returned 1 [0047.146] GetProcessHeap () returned 0x560000 [0047.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.146] GetProcessHeap () returned 0x560000 [0047.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.146] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4") returned 59 [0047.146] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.147] GetProcessHeap () returned 0x560000 [0047.147] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.147] GetProcessHeap () returned 0x560000 [0047.147] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e1b0 [0047.147] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.147] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.147] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.147] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.147] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.147] GetProcessHeap () returned 0x560000 [0047.147] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.147] lstrlenA (lpString="010001") returned 6 [0047.147] GetProcessHeap () returned 0x560000 [0047.147] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2a8 [0047.147] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3a8 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c828 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a308 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4c8 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0047.148] GetProcessHeap () returned 0x560000 [0047.148] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4c8 | out: hHeap=0x560000) returned 1 [0047.148] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cb0 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c1f8 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cb0 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1f8 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.149] GetProcessHeap () returned 0x560000 [0047.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.150] GetProcessHeap () returned 0x560000 [0047.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.151] GetProcessHeap () returned 0x560000 [0047.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.151] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.152] GetProcessHeap () returned 0x560000 [0047.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.153] GetProcessHeap () returned 0x560000 [0047.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.154] GetProcessHeap () returned 0x560000 [0047.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c828 | out: hHeap=0x560000) returned 1 [0047.154] GetProcessHeap () returned 0x560000 [0047.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.154] GetProcessHeap () returned 0x560000 [0047.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3a8 | out: hHeap=0x560000) returned 1 [0047.154] GetProcessHeap () returned 0x560000 [0047.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.154] GetProcessHeap () returned 0x560000 [0047.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.154] GetProcessHeap () returned 0x560000 [0047.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.154] WriteFile (in: hFile=0x230, lpBuffer=0x58e1b0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e1b0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.157] GetProcessHeap () returned 0x560000 [0047.157] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e1b0, Size=0x30) returned 0x58e1b0 [0047.157] GetProcessHeap () returned 0x560000 [0047.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.157] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.157] GetProcessHeap () returned 0x560000 [0047.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16c64) returned 0x5a03b0 [0047.158] ReadFile (in: hFile=0x230, lpBuffer=0x5a03b0, nNumberOfBytesToRead=0x16c64, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesRead=0x24ad7e8*=0x16c64, lpOverlapped=0x0) returned 1 [0047.159] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.159] WriteFile (in: hFile=0x230, lpBuffer=0x5a03b0*, nNumberOfBytesToWrite=0x16c64, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a03b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x16c64, lpOverlapped=0x0) returned 1 [0047.161] GetProcessHeap () returned 0x560000 [0047.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a03b0 | out: hHeap=0x560000) returned 1 [0047.162] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.162] WriteFile (in: hFile=0x230, lpBuffer=0x58e1b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e1b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.163] CloseHandle (hObject=0x230) returned 1 [0047.166] GetProcessHeap () returned 0x560000 [0047.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0047.166] GetProcessHeap () returned 0x560000 [0047.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.166] GetProcessHeap () returned 0x560000 [0047.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.166] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4" [0047.166] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4.badday" [0047.166] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\rnzwc0utsrhx.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\rnzwc0utsrhx.mp4.badday"), dwFlags=0x1) returned 1 [0047.166] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\rNZwc0utSRhX.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F") returned 1 [0047.166] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="" [0047.167] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" [0047.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\how_to_back_files.html")) returned 0x20 [0047.167] GetProcessHeap () returned 0x560000 [0047.167] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0047.167] FindNextFileW (in: hFindFile=0x58ce08, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb428a5e0, ftCreationTime.dwHighDateTime=0x1d4c5f1, ftLastAccessTime.dwLowDateTime=0xac6dfe0, ftLastAccessTime.dwHighDateTime=0x1d4d41e, ftLastWriteTime.dwLowDateTime=0xac6dfe0, ftLastWriteTime.dwHighDateTime=0x1d4d41e, nFileSizeHigh=0x0, nFileSizeLow=0x12512, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U-aWoLpVX.mkv", cAlternateFileName="U-AWOL~1.MKV")) returned 1 [0047.167] lstrcmpiW (lpString1="U-aWoLpVX.mkv", lpString2=".") returned 1 [0047.167] lstrcmpiW (lpString1="U-aWoLpVX.mkv", lpString2="..") returned 1 [0047.167] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="U-aWoLpVX.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv" [0047.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U-aWoLpVX.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.167] GetProcessHeap () returned 0x560000 [0047.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0047.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U-aWoLpVX.mkv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U-aWoLpVX.mkv", lpUsedDefaultChar=0x0) returned 14 [0047.167] lstrlenA (lpString="U-aWoLpVX.mkv") returned 13 [0047.167] lstrlenA (lpString=".badday") returned 7 [0047.167] lstrlenA (lpString=".badday") returned 7 [0047.167] lstrlenA (lpString="U-aWoLpVX.mkv") returned 13 [0047.167] lstrcmpiA (lpString1="pVX.mkv", lpString2=".badday") returned 1 [0047.167] lstrcmpiW (lpString1="U-aWoLpVX.mkv", lpString2="how_to_back_files.html") returned 1 [0047.167] lstrcmpiW (lpString1="U-aWoLpVX.mkv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.167] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.167] lstrcmpiW (lpString1="U-aWoLpVX.mkv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.167] GetProcessHeap () returned 0x560000 [0047.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0047.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\u-awolpvx.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.167] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=75026) returned 1 [0047.167] GetProcessHeap () returned 0x560000 [0047.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.168] GetProcessHeap () returned 0x560000 [0047.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.168] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv") returned 56 [0047.168] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.168] GetProcessHeap () returned 0x560000 [0047.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.168] GetProcessHeap () returned 0x560000 [0047.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e1e8 [0047.168] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.168] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.168] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.168] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.168] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.168] GetProcessHeap () returned 0x560000 [0047.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.169] lstrlenA (lpString="010001") returned 6 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2d8 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c678 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c798 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a368 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ce0 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c708 [0047.169] GetProcessHeap () returned 0x560000 [0047.169] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.169] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c708 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b90 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bc58 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b90 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.170] GetProcessHeap () returned 0x560000 [0047.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.170] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.171] GetProcessHeap () returned 0x560000 [0047.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.171] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.172] GetProcessHeap () returned 0x560000 [0047.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.173] GetProcessHeap () returned 0x560000 [0047.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.173] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.174] GetProcessHeap () returned 0x560000 [0047.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.175] GetProcessHeap () returned 0x560000 [0047.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.175] GetProcessHeap () returned 0x560000 [0047.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ce0 | out: hHeap=0x560000) returned 1 [0047.175] GetProcessHeap () returned 0x560000 [0047.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c798 | out: hHeap=0x560000) returned 1 [0047.175] GetProcessHeap () returned 0x560000 [0047.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.175] GetProcessHeap () returned 0x560000 [0047.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c678 | out: hHeap=0x560000) returned 1 [0047.175] GetProcessHeap () returned 0x560000 [0047.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.176] GetProcessHeap () returned 0x560000 [0047.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.176] GetProcessHeap () returned 0x560000 [0047.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.176] WriteFile (in: hFile=0x230, lpBuffer=0x58e1e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e1e8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.178] GetProcessHeap () returned 0x560000 [0047.178] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e1e8, Size=0x30) returned 0x58e1e8 [0047.178] GetProcessHeap () returned 0x560000 [0047.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.178] GetProcessHeap () returned 0x560000 [0047.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12512) returned 0x59f3a8 [0047.180] ReadFile (in: hFile=0x230, lpBuffer=0x59f3a8, nNumberOfBytesToRead=0x12512, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesRead=0x24ad7e8*=0x12512, lpOverlapped=0x0) returned 1 [0047.181] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.181] WriteFile (in: hFile=0x230, lpBuffer=0x59f3a8*, nNumberOfBytesToWrite=0x12512, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesWritten=0x24ad7e4*=0x12512, lpOverlapped=0x0) returned 1 [0047.182] GetProcessHeap () returned 0x560000 [0047.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f3a8 | out: hHeap=0x560000) returned 1 [0047.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.184] WriteFile (in: hFile=0x230, lpBuffer=0x58e1e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e1e8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.185] CloseHandle (hObject=0x230) returned 1 [0047.187] GetProcessHeap () returned 0x560000 [0047.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0047.187] GetProcessHeap () returned 0x560000 [0047.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.187] GetProcessHeap () returned 0x560000 [0047.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.187] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv" [0047.187] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv.badday" [0047.187] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\u-awolpvx.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\u-awolpvx.mkv.badday"), dwFlags=0x1) returned 1 [0047.188] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\U-aWoLpVX.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F") returned 1 [0047.188] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="" [0047.188] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" [0047.188] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\how_to_back_files.html")) returned 0x20 [0047.188] GetProcessHeap () returned 0x560000 [0047.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.188] FindNextFileW (in: hFindFile=0x58ce08, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e369c00, ftCreationTime.dwHighDateTime=0x1d4c582, ftLastAccessTime.dwLowDateTime=0xe31c1050, ftLastAccessTime.dwHighDateTime=0x1d4d4ea, ftLastWriteTime.dwLowDateTime=0xe31c1050, ftLastWriteTime.dwHighDateTime=0x1d4d4ea, nFileSizeHigh=0x0, nFileSizeLow=0x18c7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XjEZhbdrdB0n.flv", cAlternateFileName="XJEZHB~1.FLV")) returned 1 [0047.188] lstrcmpiW (lpString1="XjEZhbdrdB0n.flv", lpString2=".") returned 1 [0047.188] lstrcmpiW (lpString1="XjEZhbdrdB0n.flv", lpString2="..") returned 1 [0047.188] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="XjEZhbdrdB0n.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv" [0047.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XjEZhbdrdB0n.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.188] GetProcessHeap () returned 0x560000 [0047.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576b58 [0047.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XjEZhbdrdB0n.flv", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XjEZhbdrdB0n.flv", lpUsedDefaultChar=0x0) returned 17 [0047.188] lstrlenA (lpString="XjEZhbdrdB0n.flv") returned 16 [0047.188] lstrlenA (lpString=".badday") returned 7 [0047.188] lstrlenA (lpString=".badday") returned 7 [0047.188] lstrlenA (lpString="XjEZhbdrdB0n.flv") returned 16 [0047.188] lstrcmpiA (lpString1="B0n.flv", lpString2=".badday") returned 1 [0047.188] lstrcmpiW (lpString1="XjEZhbdrdB0n.flv", lpString2="how_to_back_files.html") returned 1 [0047.188] lstrcmpiW (lpString1="XjEZhbdrdB0n.flv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.188] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.188] lstrcmpiW (lpString1="XjEZhbdrdB0n.flv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.189] GetProcessHeap () returned 0x560000 [0047.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0047.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\xjezhbdrdb0n.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.189] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=101499) returned 1 [0047.189] GetProcessHeap () returned 0x560000 [0047.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.189] GetProcessHeap () returned 0x560000 [0047.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.189] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv") returned 59 [0047.189] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.189] GetProcessHeap () returned 0x560000 [0047.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.189] GetProcessHeap () returned 0x560000 [0047.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x385) returned 0x58e220 [0047.189] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.189] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.190] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.190] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.190] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.190] lstrlenA (lpString="010001") returned 6 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a248 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bbc8 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c798 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a208 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0047.190] GetProcessHeap () returned 0x560000 [0047.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.190] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf28 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b78 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bd78 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b78 | out: hHeap=0x560000) returned 1 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0047.191] GetProcessHeap () returned 0x560000 [0047.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bd78 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.192] GetProcessHeap () returned 0x560000 [0047.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.193] GetProcessHeap () returned 0x560000 [0047.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.194] GetProcessHeap () returned 0x560000 [0047.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.195] GetProcessHeap () returned 0x560000 [0047.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c798 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bbc8 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.196] GetProcessHeap () returned 0x560000 [0047.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.196] WriteFile (in: hFile=0x230, lpBuffer=0x58e220*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e220*, lpNumberOfBytesWritten=0x24ad864*=0x385, lpOverlapped=0x0) returned 1 [0047.200] GetProcessHeap () returned 0x560000 [0047.200] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e220, Size=0x30) returned 0x58e220 [0047.200] GetProcessHeap () returned 0x560000 [0047.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.200] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.200] GetProcessHeap () returned 0x560000 [0047.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18c80) returned 0x59f3a8 [0047.202] ReadFile (in: hFile=0x230, lpBuffer=0x59f3a8, nNumberOfBytesToRead=0x18c80, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesRead=0x24ad7e8*=0x18c80, lpOverlapped=0x0) returned 1 [0047.204] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.204] WriteFile (in: hFile=0x230, lpBuffer=0x59f3a8*, nNumberOfBytesToWrite=0x18c80, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesWritten=0x24ad7e4*=0x18c80, lpOverlapped=0x0) returned 1 [0047.205] GetProcessHeap () returned 0x560000 [0047.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f3a8 | out: hHeap=0x560000) returned 1 [0047.205] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.206] WriteFile (in: hFile=0x230, lpBuffer=0x58e220*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e220*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.207] CloseHandle (hObject=0x230) returned 1 [0047.210] GetProcessHeap () returned 0x560000 [0047.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0047.210] GetProcessHeap () returned 0x560000 [0047.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.210] GetProcessHeap () returned 0x560000 [0047.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.210] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv" [0047.210] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv.badday") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv.badday" [0047.210] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\xjezhbdrdb0n.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\xjezhbdrdb0n.flv.badday"), dwFlags=0x1) returned 1 [0047.210] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\XjEZhbdrdB0n.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F") returned 1 [0047.210] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\") returned="" [0047.210] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" [0047.210] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\6e8O\\F-0VzNSZc2or1F\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\6e8o\\f-0vznszc2or1f\\how_to_back_files.html")) returned 0x20 [0047.210] GetProcessHeap () returned 0x560000 [0047.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0047.210] FindNextFileW (in: hFindFile=0x58ce08, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e369c00, ftCreationTime.dwHighDateTime=0x1d4c582, ftLastAccessTime.dwLowDateTime=0xe31c1050, ftLastAccessTime.dwHighDateTime=0x1d4d4ea, ftLastWriteTime.dwLowDateTime=0xe31c1050, ftLastWriteTime.dwHighDateTime=0x1d4d4ea, nFileSizeHigh=0x0, nFileSizeLow=0x18c7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XjEZhbdrdB0n.flv", cAlternateFileName="XJEZHB~1.FLV")) returned 0 [0047.211] FindClose (in: hFindFile=0x58ce08 | out: hFindFile=0x58ce08) returned 1 [0047.211] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\" [0047.211] GetProcessHeap () returned 0x560000 [0047.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ec60 | out: hHeap=0x560000) returned 1 [0047.211] GetProcessHeap () returned 0x560000 [0047.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.211] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned 36 [0047.211] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\*") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\*" [0047.211] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83170100, ftCreationTime.dwHighDateTime=0x1d4cb1d, ftLastAccessTime.dwLowDateTime=0x29feb10, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0x29feb10, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58d308 [0047.211] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.211] FindNextFileW (in: hFindFile=0x58d308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83170100, ftCreationTime.dwHighDateTime=0x1d4cb1d, ftLastAccessTime.dwLowDateTime=0x29feb10, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0x29feb10, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.211] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.211] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.211] FindNextFileW (in: hFindFile=0x58d308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede2c30, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x25af1c00, ftLastAccessTime.dwHighDateTime=0x1d4d10d, ftLastWriteTime.dwLowDateTime=0x25af1c00, ftLastWriteTime.dwHighDateTime=0x1d4d10d, nFileSizeHigh=0x0, nFileSizeLow=0x12528, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="35_4bU6GNDoKE5zoFSV.flv", cAlternateFileName="35_4BU~1.FLV")) returned 1 [0047.211] lstrcmpiW (lpString1="35_4bU6GNDoKE5zoFSV.flv", lpString2=".") returned 1 [0047.211] lstrcmpiW (lpString1="35_4bU6GNDoKE5zoFSV.flv", lpString2="..") returned 1 [0047.211] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\", lpString2="35_4bU6GNDoKE5zoFSV.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv" [0047.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="35_4bU6GNDoKE5zoFSV.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0047.211] GetProcessHeap () returned 0x560000 [0047.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5768d8 [0047.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="35_4bU6GNDoKE5zoFSV.flv", cchWideChar=-1, lpMultiByteStr=0x5768d8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35_4bU6GNDoKE5zoFSV.flv", lpUsedDefaultChar=0x0) returned 24 [0047.211] lstrlenA (lpString="35_4bU6GNDoKE5zoFSV.flv") returned 23 [0047.211] lstrlenA (lpString=".badday") returned 7 [0047.211] lstrlenA (lpString=".badday") returned 7 [0047.211] lstrlenA (lpString="35_4bU6GNDoKE5zoFSV.flv") returned 23 [0047.211] lstrcmpiA (lpString1="FSV.flv", lpString2=".badday") returned 1 [0047.211] lstrcmpiW (lpString1="35_4bU6GNDoKE5zoFSV.flv", lpString2="how_to_back_files.html") returned -1 [0047.212] lstrcmpiW (lpString1="35_4bU6GNDoKE5zoFSV.flv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0047.212] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.212] lstrcmpiW (lpString1="35_4bU6GNDoKE5zoFSV.flv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.212] GetProcessHeap () returned 0x560000 [0047.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1e8 [0047.212] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\35_4bu6gndoke5zofsv.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.212] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=75048) returned 1 [0047.212] GetProcessHeap () returned 0x560000 [0047.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.212] GetProcessHeap () returned 0x560000 [0047.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.212] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv") returned 59 [0047.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.212] GetProcessHeap () returned 0x560000 [0047.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.212] GetProcessHeap () returned 0x560000 [0047.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58e258 [0047.212] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.212] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.213] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.213] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.213] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.213] lstrlenA (lpString="010001") returned 6 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2a8 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c1f8 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a218 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.213] GetProcessHeap () returned 0x560000 [0047.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c168 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c168 | out: hHeap=0x560000) returned 1 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e628 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c828 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e628 | out: hHeap=0x560000) returned 1 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c828 | out: hHeap=0x560000) returned 1 [0047.214] GetProcessHeap () returned 0x560000 [0047.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.214] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.215] GetProcessHeap () returned 0x560000 [0047.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.215] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.216] GetProcessHeap () returned 0x560000 [0047.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.216] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.217] GetProcessHeap () returned 0x560000 [0047.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.218] GetProcessHeap () returned 0x560000 [0047.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1f8 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.219] GetProcessHeap () returned 0x560000 [0047.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.219] WriteFile (in: hFile=0x230, lpBuffer=0x58e258*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e258*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.221] GetProcessHeap () returned 0x560000 [0047.221] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58e258, Size=0x30) returned 0x58e258 [0047.221] GetProcessHeap () returned 0x560000 [0047.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.221] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.221] GetProcessHeap () returned 0x560000 [0047.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12528) returned 0x59f3a8 [0047.221] ReadFile (in: hFile=0x230, lpBuffer=0x59f3a8, nNumberOfBytesToRead=0x12528, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesRead=0x24ad7e8*=0x12528, lpOverlapped=0x0) returned 1 [0047.222] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.222] WriteFile (in: hFile=0x230, lpBuffer=0x59f3a8*, nNumberOfBytesToWrite=0x12528, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesWritten=0x24ad7e4*=0x12528, lpOverlapped=0x0) returned 1 [0047.224] GetProcessHeap () returned 0x560000 [0047.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f3a8 | out: hHeap=0x560000) returned 1 [0047.225] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.225] WriteFile (in: hFile=0x230, lpBuffer=0x58e258*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58e258*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.227] CloseHandle (hObject=0x230) returned 1 [0047.229] GetProcessHeap () returned 0x560000 [0047.229] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1e8 | out: hHeap=0x560000) returned 1 [0047.229] GetProcessHeap () returned 0x560000 [0047.229] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.229] GetProcessHeap () returned 0x560000 [0047.229] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.229] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv" [0047.229] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv.badday") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv.badday" [0047.230] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\35_4bu6gndoke5zofsv.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\35_4bu6gndoke5zofsv.flv.badday"), dwFlags=0x1) returned 1 [0047.230] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\35_4bU6GNDoKE5zoFSV.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc") returned 1 [0047.230] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned="" [0047.230] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html" [0047.230] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\how_to_back_files.html")) returned 0xffffffff [0047.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0047.232] GetProcessHeap () returned 0x560000 [0047.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.232] GetProcessHeap () returned 0x560000 [0047.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.239] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.240] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.245] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.247] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.251] GetProcessHeap () returned 0x560000 [0047.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.251] GetProcessHeap () returned 0x560000 [0047.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.251] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0047.251] GetProcessHeap () returned 0x560000 [0047.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.251] GetProcessHeap () returned 0x560000 [0047.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.258] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.259] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.262] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.263] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.277] GetProcessHeap () returned 0x560000 [0047.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.277] GetProcessHeap () returned 0x560000 [0047.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.277] CloseHandle (hObject=0x230) returned 1 [0047.277] GetProcessHeap () returned 0x560000 [0047.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5768d8 | out: hHeap=0x560000) returned 1 [0047.278] FindNextFileW (in: hFindFile=0x58d308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3aaf0, ftCreationTime.dwHighDateTime=0x1d4d270, ftLastAccessTime.dwLowDateTime=0xd3a7ea00, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0xd3a7ea00, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WC_aDQtO.mkv", cAlternateFileName="")) returned 1 [0047.278] lstrcmpiW (lpString1="WC_aDQtO.mkv", lpString2=".") returned 1 [0047.278] lstrcmpiW (lpString1="WC_aDQtO.mkv", lpString2="..") returned 1 [0047.278] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\", lpString2="WC_aDQtO.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv" [0047.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WC_aDQtO.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.278] GetProcessHeap () returned 0x560000 [0047.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0047.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WC_aDQtO.mkv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WC_aDQtO.mkv", lpUsedDefaultChar=0x0) returned 13 [0047.278] lstrlenA (lpString="WC_aDQtO.mkv") returned 12 [0047.278] lstrlenA (lpString=".badday") returned 7 [0047.278] lstrlenA (lpString=".badday") returned 7 [0047.278] lstrlenA (lpString="WC_aDQtO.mkv") returned 12 [0047.278] lstrcmpiA (lpString1="QtO.mkv", lpString2=".badday") returned 1 [0047.278] lstrcmpiW (lpString1="WC_aDQtO.mkv", lpString2="how_to_back_files.html") returned 1 [0047.278] lstrcmpiW (lpString1="WC_aDQtO.mkv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.278] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.278] lstrcmpiW (lpString1="WC_aDQtO.mkv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.278] GetProcessHeap () returned 0x560000 [0047.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0047.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\wc_adqto.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.278] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=7068) returned 1 [0047.278] GetProcessHeap () returned 0x560000 [0047.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.278] GetProcessHeap () returned 0x560000 [0047.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.278] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv") returned 48 [0047.279] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.279] GetProcessHeap () returned 0x560000 [0047.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.279] GetProcessHeap () returned 0x560000 [0047.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x59f3a8 [0047.280] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.280] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.280] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.280] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.280] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.280] GetProcessHeap () returned 0x560000 [0047.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.280] lstrlenA (lpString="010001") returned 6 [0047.280] GetProcessHeap () returned 0x560000 [0047.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a2b8 [0047.280] GetProcessHeap () returned 0x560000 [0047.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.280] GetProcessHeap () returned 0x560000 [0047.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfb8 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c5e8 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5870f0 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a368 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e7f0 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c1f8 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c1f8 | out: hHeap=0x560000) returned 1 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.281] GetProcessHeap () returned 0x560000 [0047.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e778 [0047.281] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bf28 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e778 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.282] GetProcessHeap () returned 0x560000 [0047.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.282] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.283] GetProcessHeap () returned 0x560000 [0047.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.284] GetProcessHeap () returned 0x560000 [0047.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.284] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.286] GetProcessHeap () returned 0x560000 [0047.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.287] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c5e8 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfb8 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.288] GetProcessHeap () returned 0x560000 [0047.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.288] WriteFile (in: hFile=0x230, lpBuffer=0x59f3a8*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0047.291] GetProcessHeap () returned 0x560000 [0047.291] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59f3a8, Size=0x30) returned 0x59f3a8 [0047.291] GetProcessHeap () returned 0x560000 [0047.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.292] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.292] GetProcessHeap () returned 0x560000 [0047.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1ba0) returned 0x59f3e0 [0047.292] ReadFile (in: hFile=0x230, lpBuffer=0x59f3e0, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x59f3e0*, lpNumberOfBytesRead=0x24ad7e8*=0x1ba0, lpOverlapped=0x0) returned 1 [0047.292] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.292] WriteFile (in: hFile=0x230, lpBuffer=0x59f3e0*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x59f3e0*, lpNumberOfBytesWritten=0x24ad7e4*=0x1ba0, lpOverlapped=0x0) returned 1 [0047.293] GetProcessHeap () returned 0x560000 [0047.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f3e0 | out: hHeap=0x560000) returned 1 [0047.293] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.293] WriteFile (in: hFile=0x230, lpBuffer=0x59f3a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59f3a8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.294] CloseHandle (hObject=0x230) returned 1 [0047.295] GetProcessHeap () returned 0x560000 [0047.295] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0047.295] GetProcessHeap () returned 0x560000 [0047.295] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.295] GetProcessHeap () returned 0x560000 [0047.295] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.295] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv" [0047.295] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv.badday") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv.badday" [0047.295] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\wc_adqto.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv.badday" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\wc_adqto.mkv.badday"), dwFlags=0x1) returned 1 [0047.296] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\WC_aDQtO.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc") returned 1 [0047.296] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\") returned="" [0047.296] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html" [0047.296] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\5CXoE8Jcrysc\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\videos\\5cxoe8jcrysc\\how_to_back_files.html")) returned 0x20 [0047.296] GetProcessHeap () returned 0x560000 [0047.296] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.296] FindNextFileW (in: hFindFile=0x58d308, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3aaf0, ftCreationTime.dwHighDateTime=0x1d4d270, ftLastAccessTime.dwLowDateTime=0xd3a7ea00, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0xd3a7ea00, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WC_aDQtO.mkv", cAlternateFileName="")) returned 0 [0047.296] FindClose (in: hFindFile=0x58d308 | out: hFindFile=0x58d308) returned 1 [0047.296] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Templates\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0047.296] GetProcessHeap () returned 0x560000 [0047.296] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cf48 | out: hHeap=0x560000) returned 1 [0047.296] GetProcessHeap () returned 0x560000 [0047.296] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.296] lstrlenW (lpString="C:\\Users\\FD1HVy\\Templates\\") returned 26 [0047.296] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\*") returned="C:\\Users\\FD1HVy\\Templates\\*" [0047.296] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3aaf0, ftCreationTime.dwHighDateTime=0x1d4d270, ftLastAccessTime.dwLowDateTime=0xd3a7ea00, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0xd3a7ea00, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WC_aDQtO.mkv", cAlternateFileName="")) returned 0xffffffff [0047.297] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0047.297] GetProcessHeap () returned 0x560000 [0047.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d008 | out: hHeap=0x560000) returned 1 [0047.297] GetProcessHeap () returned 0x560000 [0047.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.297] lstrlenW (lpString="C:\\Users\\FD1HVy\\Start Menu\\") returned 27 [0047.297] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Start Menu\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\Start Menu\\*" [0047.297] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3aaf0, ftCreationTime.dwHighDateTime=0x1d4d270, ftLastAccessTime.dwLowDateTime=0xd3a7ea00, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0xd3a7ea00, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WC_aDQtO.mkv", cAlternateFileName="")) returned 0xffffffff [0047.297] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0047.297] GetProcessHeap () returned 0x560000 [0047.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582cd0 | out: hHeap=0x560000) returned 1 [0047.297] GetProcessHeap () returned 0x560000 [0047.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a398 | out: hHeap=0x560000) returned 1 [0047.297] lstrlenW (lpString="C:\\Users\\FD1HVy\\SendTo\\") returned 23 [0047.297] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\SendTo\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\*") returned="C:\\Users\\FD1HVy\\SendTo\\*" [0047.297] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3aaf0, ftCreationTime.dwHighDateTime=0x1d4d270, ftLastAccessTime.dwLowDateTime=0xd3a7ea00, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0xd3a7ea00, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WC_aDQtO.mkv", cAlternateFileName="")) returned 0xffffffff [0047.297] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0047.297] GetProcessHeap () returned 0x560000 [0047.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cfc8 | out: hHeap=0x560000) returned 1 [0047.297] GetProcessHeap () returned 0x560000 [0047.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.297] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\") returned 25 [0047.297] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\*") returned="C:\\Users\\FD1HVy\\Searches\\*" [0047.297] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0047.298] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.298] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.298] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.298] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.298] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0047.298] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0047.298] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0047.298] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini" [0047.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.298] GetProcessHeap () returned 0x560000 [0047.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0047.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0047.298] lstrlenA (lpString="desktop.ini") returned 11 [0047.298] lstrlenA (lpString=".badday") returned 7 [0047.298] lstrlenA (lpString=".badday") returned 7 [0047.298] lstrlenA (lpString="desktop.ini") returned 11 [0047.298] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0047.298] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0047.298] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.298] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.298] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.298] GetProcessHeap () returned 0x560000 [0047.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0047.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.298] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=524) returned 1 [0047.298] GetProcessHeap () returned 0x560000 [0047.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.299] GetProcessHeap () returned 0x560000 [0047.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.299] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned 36 [0047.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.299] GetProcessHeap () returned 0x560000 [0047.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.299] GetProcessHeap () returned 0x560000 [0047.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x5a03e8 [0047.299] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.299] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.299] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.299] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.299] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.299] GetProcessHeap () returned 0x560000 [0047.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.299] lstrlenA (lpString="010001") returned 6 [0047.299] GetProcessHeap () returned 0x560000 [0047.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.300] GetProcessHeap () returned 0x560000 [0047.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.300] GetProcessHeap () returned 0x560000 [0047.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c438 [0047.300] GetProcessHeap () returned 0x560000 [0047.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.300] GetProcessHeap () returned 0x560000 [0047.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58be08 [0047.300] GetProcessHeap () returned 0x560000 [0047.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0047.300] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e760 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bc58 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.303] GetProcessHeap () returned 0x560000 [0047.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.303] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bc58 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e778 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bf28 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e778 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf28 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.304] GetProcessHeap () returned 0x560000 [0047.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.304] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.305] GetProcessHeap () returned 0x560000 [0047.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.305] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1f8 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.306] GetProcessHeap () returned 0x560000 [0047.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.306] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a338 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a338 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.307] GetProcessHeap () returned 0x560000 [0047.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1f8 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.308] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e760 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58be08 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c438 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.309] GetProcessHeap () returned 0x560000 [0047.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.309] WriteFile (in: hFile=0x230, lpBuffer=0x5a03e8*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a03e8*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0047.312] GetProcessHeap () returned 0x560000 [0047.312] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a03e8, Size=0x30) returned 0x5a03e8 [0047.312] GetProcessHeap () returned 0x560000 [0047.312] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.312] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.312] GetProcessHeap () returned 0x560000 [0047.312] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x210) returned 0x58e290 [0047.312] ReadFile (in: hFile=0x230, lpBuffer=0x58e290, nNumberOfBytesToRead=0x210, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58e290*, lpNumberOfBytesRead=0x24ad7e8*=0x210, lpOverlapped=0x0) returned 1 [0047.312] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.312] WriteFile (in: hFile=0x230, lpBuffer=0x58e290*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58e290*, lpNumberOfBytesWritten=0x24ad7e4*=0x210, lpOverlapped=0x0) returned 1 [0047.313] GetProcessHeap () returned 0x560000 [0047.313] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e290 | out: hHeap=0x560000) returned 1 [0047.313] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.313] WriteFile (in: hFile=0x230, lpBuffer=0x5a03e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a03e8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.314] CloseHandle (hObject=0x230) returned 1 [0047.318] GetProcessHeap () returned 0x560000 [0047.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0047.318] GetProcessHeap () returned 0x560000 [0047.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.318] GetProcessHeap () returned 0x560000 [0047.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.318] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Searches\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini" [0047.318] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini.badday" [0047.319] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0047.319] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0047.319] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0047.319] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" [0047.319] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_to_back_files.html")) returned 0xffffffff [0047.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0047.319] GetProcessHeap () returned 0x560000 [0047.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.319] GetProcessHeap () returned 0x560000 [0047.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.338] GetProcessHeap () returned 0x560000 [0047.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.338] GetProcessHeap () returned 0x560000 [0047.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.338] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0047.338] GetProcessHeap () returned 0x560000 [0047.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.338] GetProcessHeap () returned 0x560000 [0047.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.345] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.346] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.359] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.359] GetProcessHeap () returned 0x560000 [0047.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.359] GetProcessHeap () returned 0x560000 [0047.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.359] CloseHandle (hObject=0x230) returned 1 [0047.360] GetProcessHeap () returned 0x560000 [0047.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.360] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0047.360] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".") returned 1 [0047.360] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="..") returned 1 [0047.360] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0047.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Everywhere.search-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0047.360] GetProcessHeap () returned 0x560000 [0047.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576ad8 [0047.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Everywhere.search-ms", cchWideChar=-1, lpMultiByteStr=0x576ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Everywhere.search-ms", lpUsedDefaultChar=0x0) returned 21 [0047.360] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0047.360] lstrlenA (lpString=".badday") returned 7 [0047.360] lstrlenA (lpString=".badday") returned 7 [0047.360] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0047.360] lstrcmpiA (lpString1="arch-ms", lpString2=".badday") returned 1 [0047.360] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="how_to_back_files.html") returned -1 [0047.360] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.360] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.360] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.360] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x22) returned 1 [0047.363] GetProcessHeap () returned 0x560000 [0047.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1e8 [0047.363] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.363] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=248) returned 1 [0047.363] GetProcessHeap () returned 0x560000 [0047.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.363] GetProcessHeap () returned 0x560000 [0047.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.363] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned 45 [0047.363] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.363] GetProcessHeap () returned 0x560000 [0047.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.364] GetProcessHeap () returned 0x560000 [0047.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58bb10 [0047.364] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.364] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.364] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.364] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.364] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.364] GetProcessHeap () returned 0x560000 [0047.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.364] lstrlenA (lpString="010001") returned 6 [0047.364] GetProcessHeap () returned 0x560000 [0047.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.364] GetProcessHeap () returned 0x560000 [0047.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.364] GetProcessHeap () returned 0x560000 [0047.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4f8 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca08 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.365] GetProcessHeap () returned 0x560000 [0047.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e910 [0047.365] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c228 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e910 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c228 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.366] GetProcessHeap () returned 0x560000 [0047.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.366] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a398 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a398 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.367] GetProcessHeap () returned 0x560000 [0047.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1f8 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.368] GetProcessHeap () returned 0x560000 [0047.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1f8 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.369] GetProcessHeap () returned 0x560000 [0047.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2e8 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2e8 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a398 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a398 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.370] GetProcessHeap () returned 0x560000 [0047.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0047.371] GetProcessHeap () returned 0x560000 [0047.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.371] GetProcessHeap () returned 0x560000 [0047.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0047.371] GetProcessHeap () returned 0x560000 [0047.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.371] GetProcessHeap () returned 0x560000 [0047.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.371] GetProcessHeap () returned 0x560000 [0047.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.371] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0047.376] GetProcessHeap () returned 0x560000 [0047.376] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58bb10, Size=0x30) returned 0x58bb10 [0047.376] GetProcessHeap () returned 0x560000 [0047.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.376] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.376] GetProcessHeap () returned 0x560000 [0047.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100) returned 0x570898 [0047.377] ReadFile (in: hFile=0x230, lpBuffer=0x570898, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x570898*, lpNumberOfBytesRead=0x24ad7e8*=0x100, lpOverlapped=0x0) returned 1 [0047.377] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.377] WriteFile (in: hFile=0x230, lpBuffer=0x570898*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x570898*, lpNumberOfBytesWritten=0x24ad7e4*=0x100, lpOverlapped=0x0) returned 1 [0047.378] GetProcessHeap () returned 0x560000 [0047.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0047.378] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.378] WriteFile (in: hFile=0x230, lpBuffer=0x58bb10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58bb10*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.379] CloseHandle (hObject=0x230) returned 1 [0047.380] GetProcessHeap () returned 0x560000 [0047.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1e8 | out: hHeap=0x560000) returned 1 [0047.380] GetProcessHeap () returned 0x560000 [0047.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.380] GetProcessHeap () returned 0x560000 [0047.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.380] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0047.380] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.badday") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.badday" [0047.380] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.badday" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.badday"), dwFlags=0x1) returned 1 [0047.380] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0047.381] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0047.381] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" [0047.381] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_to_back_files.html")) returned 0x20 [0047.381] GetProcessHeap () returned 0x560000 [0047.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576ad8 | out: hHeap=0x560000) returned 1 [0047.381] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0047.381] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".") returned 1 [0047.381] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="..") returned 1 [0047.381] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0047.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Indexed Locations.search-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0047.381] GetProcessHeap () returned 0x560000 [0047.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1c) returned 0x57d620 [0047.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Indexed Locations.search-ms", cchWideChar=-1, lpMultiByteStr=0x57d620, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Indexed Locations.search-ms", lpUsedDefaultChar=0x0) returned 28 [0047.381] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0047.381] lstrlenA (lpString=".badday") returned 7 [0047.381] lstrlenA (lpString=".badday") returned 7 [0047.381] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0047.381] lstrcmpiA (lpString1="arch-ms", lpString2=".badday") returned 1 [0047.381] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="how_to_back_files.html") returned 1 [0047.381] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.381] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.381] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.381] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x22) returned 1 [0047.382] GetProcessHeap () returned 0x560000 [0047.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0047.382] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.382] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=248) returned 1 [0047.382] GetProcessHeap () returned 0x560000 [0047.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.382] GetProcessHeap () returned 0x560000 [0047.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.382] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned 52 [0047.382] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.382] GetProcessHeap () returned 0x560000 [0047.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.382] GetProcessHeap () returned 0x560000 [0047.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58cea8 [0047.382] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.382] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.383] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.383] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.383] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.383] lstrlenA (lpString="010001") returned 6 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0047.383] GetProcessHeap () returned 0x560000 [0047.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e850 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bec8 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e850 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bec8 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.384] GetProcessHeap () returned 0x560000 [0047.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a398 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a398 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1f8 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.385] GetProcessHeap () returned 0x560000 [0047.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1f8 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1f8 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a248 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a248 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.386] GetProcessHeap () returned 0x560000 [0047.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2b8 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2b8 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a348 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a348 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2c8 [0047.387] GetProcessHeap () returned 0x560000 [0047.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2c8 | out: hHeap=0x560000) returned 1 [0047.387] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a288 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a288 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a308 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a308 | out: hHeap=0x560000) returned 1 [0047.388] GetProcessHeap () returned 0x560000 [0047.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.389] GetProcessHeap () returned 0x560000 [0047.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.389] WriteFile (in: hFile=0x230, lpBuffer=0x58cea8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cea8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0047.393] GetProcessHeap () returned 0x560000 [0047.393] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cea8, Size=0x30) returned 0x58cea8 [0047.393] GetProcessHeap () returned 0x560000 [0047.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.393] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.393] GetProcessHeap () returned 0x560000 [0047.393] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100) returned 0x570898 [0047.393] ReadFile (in: hFile=0x230, lpBuffer=0x570898, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x570898*, lpNumberOfBytesRead=0x24ad7e8*=0x100, lpOverlapped=0x0) returned 1 [0047.393] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.393] WriteFile (in: hFile=0x230, lpBuffer=0x570898*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x570898*, lpNumberOfBytesWritten=0x24ad7e4*=0x100, lpOverlapped=0x0) returned 1 [0047.394] GetProcessHeap () returned 0x560000 [0047.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x560000) returned 1 [0047.395] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.395] WriteFile (in: hFile=0x230, lpBuffer=0x58cea8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cea8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.395] CloseHandle (hObject=0x230) returned 1 [0047.396] GetProcessHeap () returned 0x560000 [0047.396] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0047.396] GetProcessHeap () returned 0x560000 [0047.396] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.396] GetProcessHeap () returned 0x560000 [0047.396] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.396] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0047.397] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.badday") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.badday" [0047.397] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.badday" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.badday"), dwFlags=0x1) returned 1 [0047.397] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0047.397] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0047.397] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" [0047.397] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_to_back_files.html")) returned 0x20 [0047.397] GetProcessHeap () returned 0x560000 [0047.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0047.397] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0047.397] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".") returned 1 [0047.397] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="..") returned 1 [0047.397] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0047.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0047.397] GetProcessHeap () returned 0x560000 [0047.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4b) returned 0x589d50 [0047.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cchWideChar=-1, lpMultiByteStr=0x589d50, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpUsedDefaultChar=0x0) returned 75 [0047.398] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0047.398] lstrlenA (lpString=".badday") returned 7 [0047.398] lstrlenA (lpString=".badday") returned 7 [0047.398] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0047.398] lstrcmpiA (lpString1="ctor-ms", lpString2=".badday") returned 1 [0047.398] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="how_to_back_files.html") returned 1 [0047.398] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.398] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.398] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.398] GetProcessHeap () returned 0x560000 [0047.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0047.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.399] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=855) returned 1 [0047.400] GetProcessHeap () returned 0x560000 [0047.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.400] GetProcessHeap () returned 0x560000 [0047.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.400] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 99 [0047.400] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.400] GetProcessHeap () returned 0x560000 [0047.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.400] GetProcessHeap () returned 0x560000 [0047.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58cee0 [0047.400] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.400] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.400] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.400] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.400] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.400] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.401] lstrlenA (lpString="010001") returned 6 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.401] GetProcessHeap () returned 0x560000 [0047.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfe8 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e610 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c7c8 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2d8 [0047.402] GetProcessHeap () returned 0x560000 [0047.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2d8 | out: hHeap=0x560000) returned 1 [0047.402] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a238 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a238 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a298 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a298 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.403] GetProcessHeap () returned 0x560000 [0047.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a368 [0047.403] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a368 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2a8 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2a8 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a208 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a208 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.404] GetProcessHeap () returned 0x560000 [0047.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a318 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a318 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1d8 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1d8 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a2f8 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a2f8 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a268 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a268 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a388 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a388 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a228 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a228 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a328 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a328 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a258 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a258 | out: hHeap=0x560000) returned 1 [0047.405] GetProcessHeap () returned 0x560000 [0047.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a218 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a218 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a278 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a278 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a378 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a378 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a358 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a358 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1e8 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1e8 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.406] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.407] GetProcessHeap () returned 0x560000 [0047.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.407] WriteFile (in: hFile=0x230, lpBuffer=0x58cee0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cee0*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0047.578] GetProcessHeap () returned 0x560000 [0047.578] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cee0, Size=0x30) returned 0x58cee0 [0047.578] GetProcessHeap () returned 0x560000 [0047.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.578] GetProcessHeap () returned 0x560000 [0047.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x360) returned 0x56ed60 [0047.578] ReadFile (in: hFile=0x230, lpBuffer=0x56ed60, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x56ed60*, lpNumberOfBytesRead=0x24ad7e8*=0x360, lpOverlapped=0x0) returned 1 [0047.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.578] WriteFile (in: hFile=0x230, lpBuffer=0x56ed60*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x56ed60*, lpNumberOfBytesWritten=0x24ad7e4*=0x360, lpOverlapped=0x0) returned 1 [0047.579] GetProcessHeap () returned 0x560000 [0047.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56ed60 | out: hHeap=0x560000) returned 1 [0047.580] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.580] WriteFile (in: hFile=0x230, lpBuffer=0x58cee0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cee0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.583] CloseHandle (hObject=0x230) returned 1 [0047.584] GetProcessHeap () returned 0x560000 [0047.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0047.584] GetProcessHeap () returned 0x560000 [0047.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.584] GetProcessHeap () returned 0x560000 [0047.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.584] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0047.584] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.badday") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.badday" [0047.585] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.badday" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.badday"), dwFlags=0x1) returned 1 [0047.585] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0047.585] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0047.585] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" [0047.585] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_to_back_files.html")) returned 0x20 [0047.585] GetProcessHeap () returned 0x560000 [0047.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d50 | out: hHeap=0x560000) returned 1 [0047.585] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0047.585] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0047.586] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0047.586] GetProcessHeap () returned 0x560000 [0047.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572f08 | out: hHeap=0x560000) returned 1 [0047.586] GetProcessHeap () returned 0x560000 [0047.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.586] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\") returned 28 [0047.586] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\*") returned="C:\\Users\\FD1HVy\\Saved Games\\*" [0047.586] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0047.586] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.586] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.586] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.586] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.586] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0047.586] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0047.586] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0047.586] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" [0047.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.586] GetProcessHeap () returned 0x560000 [0047.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0047.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0047.586] lstrlenA (lpString="desktop.ini") returned 11 [0047.586] lstrlenA (lpString=".badday") returned 7 [0047.586] lstrlenA (lpString=".badday") returned 7 [0047.586] lstrlenA (lpString="desktop.ini") returned 11 [0047.586] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0047.586] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0047.587] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.587] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.587] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.587] GetProcessHeap () returned 0x560000 [0047.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0047.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.587] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=282) returned 1 [0047.587] GetProcessHeap () returned 0x560000 [0047.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.587] GetProcessHeap () returned 0x560000 [0047.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.587] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned 39 [0047.587] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.587] GetProcessHeap () returned 0x560000 [0047.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.587] GetProcessHeap () returned 0x560000 [0047.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x58cf18 [0047.587] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.587] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.588] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.588] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.588] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.588] lstrlenA (lpString="010001") returned 6 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.588] GetProcessHeap () returned 0x560000 [0047.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.588] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e658 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e760 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c858 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e760 | out: hHeap=0x560000) returned 1 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.589] GetProcessHeap () returned 0x560000 [0047.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0047.589] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.590] GetProcessHeap () returned 0x560000 [0047.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.591] GetProcessHeap () returned 0x560000 [0047.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.591] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.592] GetProcessHeap () returned 0x560000 [0047.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.592] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.593] GetProcessHeap () returned 0x560000 [0047.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.593] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e658 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.594] GetProcessHeap () returned 0x560000 [0047.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.594] WriteFile (in: hFile=0x230, lpBuffer=0x58cf18*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cf18*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0047.603] GetProcessHeap () returned 0x560000 [0047.603] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cf18, Size=0x30) returned 0x58cf18 [0047.603] GetProcessHeap () returned 0x560000 [0047.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.603] GetProcessHeap () returned 0x560000 [0047.603] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x120) returned 0x58e9e8 [0047.603] ReadFile (in: hFile=0x230, lpBuffer=0x58e9e8, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58e9e8*, lpNumberOfBytesRead=0x24ad7e8*=0x120, lpOverlapped=0x0) returned 1 [0047.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.603] WriteFile (in: hFile=0x230, lpBuffer=0x58e9e8*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58e9e8*, lpNumberOfBytesWritten=0x24ad7e4*=0x120, lpOverlapped=0x0) returned 1 [0047.604] GetProcessHeap () returned 0x560000 [0047.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e9e8 | out: hHeap=0x560000) returned 1 [0047.604] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.604] WriteFile (in: hFile=0x230, lpBuffer=0x58cf18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cf18*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.608] CloseHandle (hObject=0x230) returned 1 [0047.609] GetProcessHeap () returned 0x560000 [0047.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0047.610] GetProcessHeap () returned 0x560000 [0047.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.610] GetProcessHeap () returned 0x560000 [0047.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.610] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" [0047.610] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.badday" [0047.610] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0047.610] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Saved Games") returned 1 [0047.610] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Saved Games" | out: pszPath="C:\\Users\\FD1HVy\\Saved Games\\") returned="" [0047.610] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Saved Games\\how_to_back_files.html" [0047.610] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\saved games\\how_to_back_files.html")) returned 0xffffffff [0047.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\saved games\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0047.612] GetProcessHeap () returned 0x560000 [0047.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.612] GetProcessHeap () returned 0x560000 [0047.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.626] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.627] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.628] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.628] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.628] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.628] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.628] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.637] GetProcessHeap () returned 0x560000 [0047.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.637] GetProcessHeap () returned 0x560000 [0047.637] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.637] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0047.637] GetProcessHeap () returned 0x560000 [0047.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.637] GetProcessHeap () returned 0x560000 [0047.637] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.715] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.715] GetProcessHeap () returned 0x560000 [0047.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.715] GetProcessHeap () returned 0x560000 [0047.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.715] CloseHandle (hObject=0x230) returned 1 [0047.715] GetProcessHeap () returned 0x560000 [0047.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.715] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0047.715] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0047.716] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0047.716] GetProcessHeap () returned 0x560000 [0047.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582d40 | out: hHeap=0x560000) returned 1 [0047.716] GetProcessHeap () returned 0x560000 [0047.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.716] lstrlenW (lpString="C:\\Users\\FD1HVy\\Recent\\") returned 23 [0047.716] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\*") returned="C:\\Users\\FD1HVy\\Recent\\*" [0047.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0047.716] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\PrintHood\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0047.716] GetProcessHeap () returned 0x560000 [0047.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579888 | out: hHeap=0x560000) returned 1 [0047.716] GetProcessHeap () returned 0x560000 [0047.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.716] lstrlenW (lpString="C:\\Users\\FD1HVy\\PrintHood\\") returned 26 [0047.716] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\PrintHood\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\*") returned="C:\\Users\\FD1HVy\\PrintHood\\*" [0047.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0047.716] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0047.716] GetProcessHeap () returned 0x560000 [0047.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579848 | out: hHeap=0x560000) returned 1 [0047.716] GetProcessHeap () returned 0x560000 [0047.716] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.716] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\") returned 25 [0047.716] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\*" [0047.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53c78550, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53c78550, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0047.717] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.717] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53c78550, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53c78550, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.717] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.717] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.717] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67794560, ftCreationTime.dwHighDateTime=0x1d4d3b1, ftLastAccessTime.dwLowDateTime=0x8b7aa7c0, ftLastAccessTime.dwHighDateTime=0x1d4ca9b, ftLastWriteTime.dwLowDateTime=0x8b7aa7c0, ftLastWriteTime.dwHighDateTime=0x1d4ca9b, nFileSizeHigh=0x0, nFileSizeLow=0x135eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-upO1oDZZj odXbta0.gif", cAlternateFileName="-UPO1O~1.GIF")) returned 1 [0047.717] lstrcmpiW (lpString1="-upO1oDZZj odXbta0.gif", lpString2=".") returned 1 [0047.717] lstrcmpiW (lpString1="-upO1oDZZj odXbta0.gif", lpString2="..") returned 1 [0047.717] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="-upO1oDZZj odXbta0.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif" [0047.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-upO1oDZZj odXbta0.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0047.717] GetProcessHeap () returned 0x560000 [0047.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576b78 [0047.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-upO1oDZZj odXbta0.gif", cchWideChar=-1, lpMultiByteStr=0x576b78, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-upO1oDZZj odXbta0.gif", lpUsedDefaultChar=0x0) returned 23 [0047.717] lstrlenA (lpString="-upO1oDZZj odXbta0.gif") returned 22 [0047.717] lstrlenA (lpString=".badday") returned 7 [0047.717] lstrlenA (lpString=".badday") returned 7 [0047.717] lstrlenA (lpString="-upO1oDZZj odXbta0.gif") returned 22 [0047.717] lstrcmpiA (lpString1="ta0.gif", lpString2=".badday") returned 1 [0047.717] lstrcmpiW (lpString1="-upO1oDZZj odXbta0.gif", lpString2="how_to_back_files.html") returned 1 [0047.717] lstrcmpiW (lpString1="-upO1oDZZj odXbta0.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.717] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.717] lstrcmpiW (lpString1="-upO1oDZZj odXbta0.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0047.717] GetProcessHeap () returned 0x560000 [0047.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0047.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-upo1odzzj odxbta0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.718] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=79339) returned 1 [0047.718] GetProcessHeap () returned 0x560000 [0047.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.718] GetProcessHeap () returned 0x560000 [0047.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.718] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif") returned 47 [0047.718] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.718] GetProcessHeap () returned 0x560000 [0047.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.719] GetProcessHeap () returned 0x560000 [0047.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58cf50 [0047.719] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.719] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.719] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.719] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.719] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.719] GetProcessHeap () returned 0x560000 [0047.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.719] lstrlenA (lpString="010001") returned 6 [0047.719] GetProcessHeap () returned 0x560000 [0047.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0047.719] GetProcessHeap () returned 0x560000 [0047.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.719] GetProcessHeap () returned 0x560000 [0047.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587208 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e970 [0047.720] GetProcessHeap () returned 0x560000 [0047.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c7c8 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.721] GetProcessHeap () returned 0x560000 [0047.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.722] GetProcessHeap () returned 0x560000 [0047.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.722] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.723] GetProcessHeap () returned 0x560000 [0047.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.724] GetProcessHeap () returned 0x560000 [0047.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.724] GetProcessHeap () returned 0x560000 [0047.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0047.725] GetProcessHeap () returned 0x560000 [0047.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.726] GetProcessHeap () returned 0x560000 [0047.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.726] GetProcessHeap () returned 0x560000 [0047.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.726] WriteFile (in: hFile=0x230, lpBuffer=0x58cf50*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cf50*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.731] GetProcessHeap () returned 0x560000 [0047.731] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cf50, Size=0x30) returned 0x58cf50 [0047.731] GetProcessHeap () returned 0x560000 [0047.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.731] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.731] GetProcessHeap () returned 0x560000 [0047.731] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x135eb) returned 0x5a0420 [0047.732] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x135eb, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x135eb, lpOverlapped=0x0) returned 1 [0047.733] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.733] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x135eb, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x135eb, lpOverlapped=0x0) returned 1 [0047.735] GetProcessHeap () returned 0x560000 [0047.735] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.735] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.735] WriteFile (in: hFile=0x230, lpBuffer=0x58cf50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cf50*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.736] CloseHandle (hObject=0x230) returned 1 [0047.738] GetProcessHeap () returned 0x560000 [0047.738] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0047.738] GetProcessHeap () returned 0x560000 [0047.739] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.739] GetProcessHeap () returned 0x560000 [0047.739] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.739] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif" [0047.739] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif.badday" [0047.739] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-upo1odzzj odxbta0.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\-upo1odzzj odxbta0.gif.badday"), dwFlags=0x1) returned 1 [0047.740] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\-upO1oDZZj odXbta0.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.740] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.740] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.740] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0xffffffff [0047.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0047.741] GetProcessHeap () returned 0x560000 [0047.741] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.741] GetProcessHeap () returned 0x560000 [0047.741] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.758] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.759] GetProcessHeap () returned 0x560000 [0047.759] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.759] GetProcessHeap () returned 0x560000 [0047.759] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.760] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0047.760] GetProcessHeap () returned 0x560000 [0047.760] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.760] GetProcessHeap () returned 0x560000 [0047.760] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.773] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.774] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.777] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.779] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.795] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.795] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.795] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0047.800] GetProcessHeap () returned 0x560000 [0047.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.800] GetProcessHeap () returned 0x560000 [0047.800] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.800] CloseHandle (hObject=0x230) returned 1 [0047.800] GetProcessHeap () returned 0x560000 [0047.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b78 | out: hHeap=0x560000) returned 1 [0047.801] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce311780, ftCreationTime.dwHighDateTime=0x1d4d111, ftLastAccessTime.dwLowDateTime=0x404e4f30, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0x404e4f30, ftLastWriteTime.dwHighDateTime=0x1d4cfd3, nFileSizeHigh=0x0, nFileSizeLow=0x2e21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Tl9-nlGPlU4HXq_BVJ.jpg", cAlternateFileName="5TL9-N~1.JPG")) returned 1 [0047.801] lstrcmpiW (lpString1="5Tl9-nlGPlU4HXq_BVJ.jpg", lpString2=".") returned 1 [0047.801] lstrcmpiW (lpString1="5Tl9-nlGPlU4HXq_BVJ.jpg", lpString2="..") returned 1 [0047.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="5Tl9-nlGPlU4HXq_BVJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg" [0047.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5Tl9-nlGPlU4HXq_BVJ.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0047.801] GetProcessHeap () returned 0x560000 [0047.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576898 [0047.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5Tl9-nlGPlU4HXq_BVJ.jpg", cchWideChar=-1, lpMultiByteStr=0x576898, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5Tl9-nlGPlU4HXq_BVJ.jpg", lpUsedDefaultChar=0x0) returned 24 [0047.801] lstrlenA (lpString="5Tl9-nlGPlU4HXq_BVJ.jpg") returned 23 [0047.801] lstrlenA (lpString=".badday") returned 7 [0047.801] lstrlenA (lpString=".badday") returned 7 [0047.801] lstrlenA (lpString="5Tl9-nlGPlU4HXq_BVJ.jpg") returned 23 [0047.801] lstrcmpiA (lpString1="BVJ.jpg", lpString2=".badday") returned 1 [0047.801] lstrcmpiW (lpString1="5Tl9-nlGPlU4HXq_BVJ.jpg", lpString2="how_to_back_files.html") returned -1 [0047.801] lstrcmpiW (lpString1="5Tl9-nlGPlU4HXq_BVJ.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0047.801] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.801] lstrcmpiW (lpString1="5Tl9-nlGPlU4HXq_BVJ.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.801] GetProcessHeap () returned 0x560000 [0047.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0047.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5tl9-nlgplu4hxq_bvj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.801] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=11809) returned 1 [0047.801] GetProcessHeap () returned 0x560000 [0047.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.802] GetProcessHeap () returned 0x560000 [0047.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.802] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg") returned 48 [0047.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.802] GetProcessHeap () returned 0x560000 [0047.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.802] GetProcessHeap () returned 0x560000 [0047.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58cf88 [0047.802] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.802] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.803] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.803] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.803] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.803] lstrlenA (lpString="010001") returned 6 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca08 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0047.803] GetProcessHeap () returned 0x560000 [0047.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.803] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf58 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e850 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca98 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e850 | out: hHeap=0x560000) returned 1 [0047.804] GetProcessHeap () returned 0x560000 [0047.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.804] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.805] GetProcessHeap () returned 0x560000 [0047.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.805] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.806] GetProcessHeap () returned 0x560000 [0047.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.806] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.807] GetProcessHeap () returned 0x560000 [0047.807] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.808] GetProcessHeap () returned 0x560000 [0047.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.809] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.810] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0047.810] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.810] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0047.810] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.810] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.810] GetProcessHeap () returned 0x560000 [0047.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.810] WriteFile (in: hFile=0x230, lpBuffer=0x58cf88*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cf88*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.813] GetProcessHeap () returned 0x560000 [0047.813] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cf88, Size=0x30) returned 0x58cf88 [0047.813] GetProcessHeap () returned 0x560000 [0047.813] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.813] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.813] GetProcessHeap () returned 0x560000 [0047.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2e21) returned 0x5a0420 [0047.813] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x2e21, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x2e21, lpOverlapped=0x0) returned 1 [0047.814] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.814] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x2e21, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x2e21, lpOverlapped=0x0) returned 1 [0047.815] GetProcessHeap () returned 0x560000 [0047.815] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.815] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.815] WriteFile (in: hFile=0x230, lpBuffer=0x58cf88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cf88*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.817] CloseHandle (hObject=0x230) returned 1 [0047.818] GetProcessHeap () returned 0x560000 [0047.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0047.818] GetProcessHeap () returned 0x560000 [0047.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.818] GetProcessHeap () returned 0x560000 [0047.818] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.818] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg" [0047.818] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg.badday" [0047.819] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\5tl9-nlgplu4hxq_bvj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\5tl9-nlgplu4hxq_bvj.jpg.badday"), dwFlags=0x1) returned 1 [0047.819] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\5Tl9-nlGPlU4HXq_BVJ.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.819] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.819] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.819] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.819] GetProcessHeap () returned 0x560000 [0047.819] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576898 | out: hHeap=0x560000) returned 1 [0047.819] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb191020, ftCreationTime.dwHighDateTime=0x1d4c68c, ftLastAccessTime.dwLowDateTime=0x96df800, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x96df800, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0xcaf7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6i0XPBa.png", cAlternateFileName="")) returned 1 [0047.819] lstrcmpiW (lpString1="6i0XPBa.png", lpString2=".") returned 1 [0047.819] lstrcmpiW (lpString1="6i0XPBa.png", lpString2="..") returned 1 [0047.819] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="6i0XPBa.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png") returned="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png" [0047.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6i0XPBa.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.819] GetProcessHeap () returned 0x560000 [0047.819] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0047.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6i0XPBa.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6i0XPBa.png", lpUsedDefaultChar=0x0) returned 12 [0047.819] lstrlenA (lpString="6i0XPBa.png") returned 11 [0047.819] lstrlenA (lpString=".badday") returned 7 [0047.819] lstrlenA (lpString=".badday") returned 7 [0047.820] lstrlenA (lpString="6i0XPBa.png") returned 11 [0047.820] lstrcmpiA (lpString1="PBa.png", lpString2=".badday") returned 1 [0047.820] lstrcmpiW (lpString1="6i0XPBa.png", lpString2="how_to_back_files.html") returned -1 [0047.820] lstrcmpiW (lpString1="6i0XPBa.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0047.820] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.820] lstrcmpiW (lpString1="6i0XPBa.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.820] GetProcessHeap () returned 0x560000 [0047.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0047.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6i0xpba.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.820] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=51959) returned 1 [0047.820] GetProcessHeap () returned 0x560000 [0047.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.820] GetProcessHeap () returned 0x560000 [0047.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.820] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png") returned 36 [0047.820] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.820] GetProcessHeap () returned 0x560000 [0047.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.820] GetProcessHeap () returned 0x560000 [0047.820] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58cfc0 [0047.820] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.820] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x572708) returned 1 [0047.821] CryptGenRandom (in: hProv=0x572708, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.821] CryptReleaseContext (hProv=0x572708, dwFlags=0x0) returned 1 [0047.821] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.821] lstrlenA (lpString="010001") returned 6 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c978 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c618 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586ec0 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.821] GetProcessHeap () returned 0x560000 [0047.821] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.821] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x570aa8 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e940 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58e958 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c4f8 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e958 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0047.822] GetProcessHeap () returned 0x560000 [0047.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0047.822] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.823] GetProcessHeap () returned 0x560000 [0047.823] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.824] GetProcessHeap () returned 0x560000 [0047.824] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.825] GetProcessHeap () returned 0x560000 [0047.825] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.825] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.826] GetProcessHeap () returned 0x560000 [0047.826] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.826] GetProcessHeap () returned 0x560000 [0047.827] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.827] GetProcessHeap () returned 0x560000 [0047.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e940 | out: hHeap=0x560000) returned 1 [0047.828] GetProcessHeap () returned 0x560000 [0047.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0047.828] GetProcessHeap () returned 0x560000 [0047.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.828] GetProcessHeap () returned 0x560000 [0047.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c978 | out: hHeap=0x560000) returned 1 [0047.828] GetProcessHeap () returned 0x560000 [0047.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.828] GetProcessHeap () returned 0x560000 [0047.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.828] GetProcessHeap () returned 0x560000 [0047.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.828] WriteFile (in: hFile=0x230, lpBuffer=0x58cfc0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cfc0*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0047.830] GetProcessHeap () returned 0x560000 [0047.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cfc0, Size=0x30) returned 0x58cfc0 [0047.830] GetProcessHeap () returned 0x560000 [0047.830] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.830] GetProcessHeap () returned 0x560000 [0047.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xcb00) returned 0x5a0420 [0047.830] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0xcb00, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0xcb00, lpOverlapped=0x0) returned 1 [0047.831] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.831] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0xcb00, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0xcb00, lpOverlapped=0x0) returned 1 [0047.834] GetProcessHeap () returned 0x560000 [0047.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.834] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.834] WriteFile (in: hFile=0x230, lpBuffer=0x58cfc0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cfc0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.835] CloseHandle (hObject=0x230) returned 1 [0047.837] GetProcessHeap () returned 0x560000 [0047.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0047.837] GetProcessHeap () returned 0x560000 [0047.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.837] GetProcessHeap () returned 0x560000 [0047.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.837] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png") returned="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png" [0047.837] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png.badday" [0047.837] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6i0xpba.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\6i0xpba.png.badday"), dwFlags=0x1) returned 1 [0047.838] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\6i0XPBa.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.838] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.838] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.838] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.838] GetProcessHeap () returned 0x560000 [0047.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.838] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd410b90, ftCreationTime.dwHighDateTime=0x1d4d4b6, ftLastAccessTime.dwLowDateTime=0xe42fee0, ftLastAccessTime.dwHighDateTime=0x1d4cdea, ftLastWriteTime.dwLowDateTime=0xe42fee0, ftLastWriteTime.dwHighDateTime=0x1d4cdea, nFileSizeHigh=0x0, nFileSizeLow=0x7c06, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7eHAXBK.png", cAlternateFileName="")) returned 1 [0047.838] lstrcmpiW (lpString1="7eHAXBK.png", lpString2=".") returned 1 [0047.838] lstrcmpiW (lpString1="7eHAXBK.png", lpString2="..") returned 1 [0047.838] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="7eHAXBK.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png") returned="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png" [0047.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7eHAXBK.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.838] GetProcessHeap () returned 0x560000 [0047.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0047.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7eHAXBK.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7eHAXBK.png", lpUsedDefaultChar=0x0) returned 12 [0047.838] lstrlenA (lpString="7eHAXBK.png") returned 11 [0047.838] lstrlenA (lpString=".badday") returned 7 [0047.838] lstrlenA (lpString=".badday") returned 7 [0047.838] lstrlenA (lpString="7eHAXBK.png") returned 11 [0047.838] lstrcmpiA (lpString1="XBK.png", lpString2=".badday") returned 1 [0047.838] lstrcmpiW (lpString1="7eHAXBK.png", lpString2="how_to_back_files.html") returned -1 [0047.839] lstrcmpiW (lpString1="7eHAXBK.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0047.839] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.839] lstrcmpiW (lpString1="7eHAXBK.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.839] GetProcessHeap () returned 0x560000 [0047.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0047.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7ehaxbk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.839] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=31750) returned 1 [0047.839] GetProcessHeap () returned 0x560000 [0047.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.839] GetProcessHeap () returned 0x560000 [0047.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.839] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png") returned 36 [0047.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.839] GetProcessHeap () returned 0x560000 [0047.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.839] GetProcessHeap () returned 0x560000 [0047.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58cff8 [0047.839] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.839] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58ea98) returned 1 [0047.840] CryptGenRandom (in: hProv=0x58ea98, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.840] CryptReleaseContext (hProv=0x58ea98, dwFlags=0x0) returned 1 [0047.840] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58ea98 [0047.840] lstrlenA (lpString="010001") returned 6 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.840] GetProcessHeap () returned 0x560000 [0047.840] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586718 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b78 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca08 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.841] GetProcessHeap () returned 0x560000 [0047.841] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.842] GetProcessHeap () returned 0x560000 [0047.842] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.843] GetProcessHeap () returned 0x560000 [0047.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.844] GetProcessHeap () returned 0x560000 [0047.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.845] GetProcessHeap () returned 0x560000 [0047.845] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0047.845] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b78 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.846] GetProcessHeap () returned 0x560000 [0047.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ea98 | out: hHeap=0x560000) returned 1 [0047.846] WriteFile (in: hFile=0x230, lpBuffer=0x58cff8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cff8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.848] GetProcessHeap () returned 0x560000 [0047.848] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58cff8, Size=0x30) returned 0x58cff8 [0047.848] GetProcessHeap () returned 0x560000 [0047.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.848] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.848] GetProcessHeap () returned 0x560000 [0047.848] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7c06) returned 0x5a0420 [0047.848] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x7c06, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x7c06, lpOverlapped=0x0) returned 1 [0047.849] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.849] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x7c06, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x7c06, lpOverlapped=0x0) returned 1 [0047.850] GetProcessHeap () returned 0x560000 [0047.850] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.851] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.851] WriteFile (in: hFile=0x230, lpBuffer=0x58cff8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58cff8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.852] CloseHandle (hObject=0x230) returned 1 [0047.854] GetProcessHeap () returned 0x560000 [0047.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0047.854] GetProcessHeap () returned 0x560000 [0047.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.854] GetProcessHeap () returned 0x560000 [0047.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.854] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png") returned="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png" [0047.854] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png.badday" [0047.854] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7ehaxbk.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\7ehaxbk.png.badday"), dwFlags=0x1) returned 1 [0047.855] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\7eHAXBK.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.855] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.855] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.855] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.855] GetProcessHeap () returned 0x560000 [0047.855] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.855] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d2aa0, ftCreationTime.dwHighDateTime=0x1d4ce87, ftLastAccessTime.dwLowDateTime=0x5232d8e0, ftLastAccessTime.dwHighDateTime=0x1d4d5e8, ftLastWriteTime.dwLowDateTime=0x5232d8e0, ftLastWriteTime.dwHighDateTime=0x1d4d5e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e89, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7FlJU.png", cAlternateFileName="")) returned 1 [0047.855] lstrcmpiW (lpString1="7FlJU.png", lpString2=".") returned 1 [0047.855] lstrcmpiW (lpString1="7FlJU.png", lpString2="..") returned 1 [0047.855] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="7FlJU.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png") returned="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png" [0047.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7FlJU.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.855] GetProcessHeap () returned 0x560000 [0047.855] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0047.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7FlJU.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7FlJU.png", lpUsedDefaultChar=0x0) returned 10 [0047.855] lstrlenA (lpString="7FlJU.png") returned 9 [0047.855] lstrlenA (lpString=".badday") returned 7 [0047.855] lstrlenA (lpString=".badday") returned 7 [0047.855] lstrlenA (lpString="7FlJU.png") returned 9 [0047.855] lstrcmpiA (lpString1="lJU.png", lpString2=".badday") returned 1 [0047.855] lstrcmpiW (lpString1="7FlJU.png", lpString2="how_to_back_files.html") returned -1 [0047.855] lstrcmpiW (lpString1="7FlJU.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0047.855] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.855] lstrcmpiW (lpString1="7FlJU.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.855] GetProcessHeap () returned 0x560000 [0047.855] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0047.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7flju.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.856] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81545) returned 1 [0047.856] GetProcessHeap () returned 0x560000 [0047.856] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.856] GetProcessHeap () returned 0x560000 [0047.856] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.856] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png") returned 34 [0047.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.856] GetProcessHeap () returned 0x560000 [0047.856] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.856] GetProcessHeap () returned 0x560000 [0047.856] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58d030 [0047.856] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.856] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58ea98) returned 1 [0047.856] CryptGenRandom (in: hProv=0x58ea98, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.856] CryptReleaseContext (hProv=0x58ea98, dwFlags=0x0) returned 1 [0047.856] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58ea98 [0047.857] lstrlenA (lpString="010001") returned 6 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c228 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.857] GetProcessHeap () returned 0x560000 [0047.857] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cf8 [0047.857] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d40 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cb28 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d40 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.858] GetProcessHeap () returned 0x560000 [0047.858] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.858] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.859] GetProcessHeap () returned 0x560000 [0047.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.860] GetProcessHeap () returned 0x560000 [0047.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.861] GetProcessHeap () returned 0x560000 [0047.861] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.862] GetProcessHeap () returned 0x560000 [0047.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.862] GetProcessHeap () returned 0x560000 [0047.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cf8 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c228 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.863] GetProcessHeap () returned 0x560000 [0047.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ea98 | out: hHeap=0x560000) returned 1 [0047.863] WriteFile (in: hFile=0x230, lpBuffer=0x58d030*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d030*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0047.879] GetProcessHeap () returned 0x560000 [0047.879] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d030, Size=0x30) returned 0x58d030 [0047.879] GetProcessHeap () returned 0x560000 [0047.879] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.879] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.879] GetProcessHeap () returned 0x560000 [0047.879] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13e89) returned 0x5a0420 [0047.882] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x13e89, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x13e89, lpOverlapped=0x0) returned 1 [0047.883] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.883] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x13e89, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x13e89, lpOverlapped=0x0) returned 1 [0047.884] GetProcessHeap () returned 0x560000 [0047.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.884] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.884] WriteFile (in: hFile=0x230, lpBuffer=0x58d030*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d030*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.885] CloseHandle (hObject=0x230) returned 1 [0047.888] GetProcessHeap () returned 0x560000 [0047.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0047.888] GetProcessHeap () returned 0x560000 [0047.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.888] GetProcessHeap () returned 0x560000 [0047.888] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.888] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png") returned="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png" [0047.888] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png.badday" [0047.888] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7flju.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\7flju.png.badday"), dwFlags=0x1) returned 1 [0047.888] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\7FlJU.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.888] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.888] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.889] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.889] GetProcessHeap () returned 0x560000 [0047.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.889] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d7bb0, ftCreationTime.dwHighDateTime=0x1d4d347, ftLastAccessTime.dwLowDateTime=0x9de18780, ftLastAccessTime.dwHighDateTime=0x1d4ca73, ftLastWriteTime.dwLowDateTime=0x9de18780, ftLastWriteTime.dwHighDateTime=0x1d4ca73, nFileSizeHigh=0x0, nFileSizeLow=0x8e8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AhU08XjAC_Z6BrVkDX.gif", cAlternateFileName="AHU08X~1.GIF")) returned 1 [0047.889] lstrcmpiW (lpString1="AhU08XjAC_Z6BrVkDX.gif", lpString2=".") returned 1 [0047.889] lstrcmpiW (lpString1="AhU08XjAC_Z6BrVkDX.gif", lpString2="..") returned 1 [0047.889] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="AhU08XjAC_Z6BrVkDX.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif") returned="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif" [0047.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AhU08XjAC_Z6BrVkDX.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0047.889] GetProcessHeap () returned 0x560000 [0047.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x5769f8 [0047.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AhU08XjAC_Z6BrVkDX.gif", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AhU08XjAC_Z6BrVkDX.gif", lpUsedDefaultChar=0x0) returned 23 [0047.889] lstrlenA (lpString="AhU08XjAC_Z6BrVkDX.gif") returned 22 [0047.889] lstrlenA (lpString=".badday") returned 7 [0047.889] lstrlenA (lpString=".badday") returned 7 [0047.889] lstrlenA (lpString="AhU08XjAC_Z6BrVkDX.gif") returned 22 [0047.889] lstrcmpiA (lpString1="kDX.gif", lpString2=".badday") returned 1 [0047.889] lstrcmpiW (lpString1="AhU08XjAC_Z6BrVkDX.gif", lpString2="how_to_back_files.html") returned -1 [0047.889] lstrcmpiW (lpString1="AhU08XjAC_Z6BrVkDX.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.889] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.889] lstrcmpiW (lpString1="AhU08XjAC_Z6BrVkDX.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.889] GetProcessHeap () returned 0x560000 [0047.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0047.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ahu08xjac_z6brvkdx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.889] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=36494) returned 1 [0047.889] GetProcessHeap () returned 0x560000 [0047.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.889] GetProcessHeap () returned 0x560000 [0047.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.890] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif") returned 47 [0047.890] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.890] GetProcessHeap () returned 0x560000 [0047.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.890] GetProcessHeap () returned 0x560000 [0047.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x58d068 [0047.890] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.890] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58ea98) returned 1 [0047.890] CryptGenRandom (in: hProv=0x58ea98, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.890] CryptReleaseContext (hProv=0x58ea98, dwFlags=0x0) returned 1 [0047.890] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.890] GetProcessHeap () returned 0x560000 [0047.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58ea98 [0047.890] lstrlenA (lpString="010001") returned 6 [0047.890] GetProcessHeap () returned 0x560000 [0047.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c7c8 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.891] GetProcessHeap () returned 0x560000 [0047.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0047.891] GetProcessHeap () returned 0x560000 [0047.921] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.921] GetProcessHeap () returned 0x560000 [0047.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0047.921] GetProcessHeap () returned 0x560000 [0047.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.921] GetProcessHeap () returned 0x560000 [0047.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0047.921] GetProcessHeap () returned 0x560000 [0047.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.921] GetProcessHeap () returned 0x560000 [0047.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.921] GetProcessHeap () returned 0x560000 [0047.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0047.921] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d58 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c858 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d58 | out: hHeap=0x560000) returned 1 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.922] GetProcessHeap () returned 0x560000 [0047.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.923] GetProcessHeap () returned 0x560000 [0047.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.924] GetProcessHeap () returned 0x560000 [0047.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.925] GetProcessHeap () returned 0x560000 [0047.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.925] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.926] GetProcessHeap () returned 0x560000 [0047.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.927] GetProcessHeap () returned 0x560000 [0047.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ea98 | out: hHeap=0x560000) returned 1 [0047.927] WriteFile (in: hFile=0x230, lpBuffer=0x58d068*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d068*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0047.930] GetProcessHeap () returned 0x560000 [0047.930] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d068, Size=0x30) returned 0x58d068 [0047.930] GetProcessHeap () returned 0x560000 [0047.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.930] GetProcessHeap () returned 0x560000 [0047.930] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8e90) returned 0x5a0420 [0047.930] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x8e90, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x8e90, lpOverlapped=0x0) returned 1 [0047.931] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.931] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x8e90, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x8e90, lpOverlapped=0x0) returned 1 [0047.933] GetProcessHeap () returned 0x560000 [0047.933] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.934] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.934] WriteFile (in: hFile=0x230, lpBuffer=0x58d068*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d068*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.935] CloseHandle (hObject=0x230) returned 1 [0047.937] GetProcessHeap () returned 0x560000 [0047.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0047.937] GetProcessHeap () returned 0x560000 [0047.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.937] GetProcessHeap () returned 0x560000 [0047.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.937] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif") returned="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif" [0047.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif.badday" [0047.937] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ahu08xjac_z6brvkdx.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\ahu08xjac_z6brvkdx.gif.badday"), dwFlags=0x1) returned 1 [0047.937] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\AhU08XjAC_Z6BrVkDX.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.937] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.937] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.937] GetProcessHeap () returned 0x560000 [0047.938] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0047.938] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf967d00, ftCreationTime.dwHighDateTime=0x1d4ca6b, ftLastAccessTime.dwLowDateTime=0x3dd7310, ftLastAccessTime.dwHighDateTime=0x1d4d02c, ftLastWriteTime.dwLowDateTime=0x3dd7310, ftLastWriteTime.dwHighDateTime=0x1d4d02c, nFileSizeHigh=0x0, nFileSizeLow=0x1162f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bLaD6 4BFxrAKmcLy.jpg", cAlternateFileName="BLAD64~1.JPG")) returned 1 [0047.938] lstrcmpiW (lpString1="bLaD6 4BFxrAKmcLy.jpg", lpString2=".") returned 1 [0047.938] lstrcmpiW (lpString1="bLaD6 4BFxrAKmcLy.jpg", lpString2="..") returned 1 [0047.938] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="bLaD6 4BFxrAKmcLy.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg" [0047.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bLaD6 4BFxrAKmcLy.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0047.938] GetProcessHeap () returned 0x560000 [0047.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576a58 [0047.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bLaD6 4BFxrAKmcLy.jpg", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bLaD6 4BFxrAKmcLy.jpg", lpUsedDefaultChar=0x0) returned 22 [0047.938] lstrlenA (lpString="bLaD6 4BFxrAKmcLy.jpg") returned 21 [0047.938] lstrlenA (lpString=".badday") returned 7 [0047.938] lstrlenA (lpString=".badday") returned 7 [0047.938] lstrlenA (lpString="bLaD6 4BFxrAKmcLy.jpg") returned 21 [0047.938] lstrcmpiA (lpString1="cLy.jpg", lpString2=".badday") returned 1 [0047.938] lstrcmpiW (lpString1="bLaD6 4BFxrAKmcLy.jpg", lpString2="how_to_back_files.html") returned -1 [0047.938] lstrcmpiW (lpString1="bLaD6 4BFxrAKmcLy.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.938] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.938] lstrcmpiW (lpString1="bLaD6 4BFxrAKmcLy.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.938] GetProcessHeap () returned 0x560000 [0047.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0047.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\blad6 4bfxrakmcly.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.938] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=71215) returned 1 [0047.938] GetProcessHeap () returned 0x560000 [0047.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.938] GetProcessHeap () returned 0x560000 [0047.938] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.939] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg") returned 46 [0047.939] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.939] GetProcessHeap () returned 0x560000 [0047.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.939] GetProcessHeap () returned 0x560000 [0047.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x58d0a0 [0047.939] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.939] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58ea98) returned 1 [0047.939] CryptGenRandom (in: hProv=0x58ea98, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.939] CryptReleaseContext (hProv=0x58ea98, dwFlags=0x0) returned 1 [0047.939] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.939] GetProcessHeap () returned 0x560000 [0047.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58ea98 [0047.939] lstrlenA (lpString="010001") returned 6 [0047.939] GetProcessHeap () returned 0x560000 [0047.939] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c7c8 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c618 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x572708 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c108 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0047.940] GetProcessHeap () returned 0x560000 [0047.940] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c108 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cb0 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c198 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cb0 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.941] GetProcessHeap () returned 0x560000 [0047.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.941] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.942] GetProcessHeap () returned 0x560000 [0047.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.943] GetProcessHeap () returned 0x560000 [0047.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.943] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.944] GetProcessHeap () returned 0x560000 [0047.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.944] GetProcessHeap () returned 0x560000 [0047.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.945] GetProcessHeap () returned 0x560000 [0047.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.946] GetProcessHeap () returned 0x560000 [0047.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0047.946] GetProcessHeap () returned 0x560000 [0047.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.946] GetProcessHeap () returned 0x560000 [0047.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0047.946] GetProcessHeap () returned 0x560000 [0047.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.946] GetProcessHeap () returned 0x560000 [0047.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0047.946] GetProcessHeap () returned 0x560000 [0047.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ea98 | out: hHeap=0x560000) returned 1 [0047.946] WriteFile (in: hFile=0x230, lpBuffer=0x58d0a0*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d0a0*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0047.948] GetProcessHeap () returned 0x560000 [0047.948] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d0a0, Size=0x30) returned 0x58d0a0 [0047.948] GetProcessHeap () returned 0x560000 [0047.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.948] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.948] GetProcessHeap () returned 0x560000 [0047.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11630) returned 0x5a0420 [0047.950] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x11630, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x11630, lpOverlapped=0x0) returned 1 [0047.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.951] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x11630, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x11630, lpOverlapped=0x0) returned 1 [0047.953] GetProcessHeap () returned 0x560000 [0047.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.953] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.953] WriteFile (in: hFile=0x230, lpBuffer=0x58d0a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d0a0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.954] CloseHandle (hObject=0x230) returned 1 [0047.957] GetProcessHeap () returned 0x560000 [0047.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0047.957] GetProcessHeap () returned 0x560000 [0047.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.957] GetProcessHeap () returned 0x560000 [0047.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.957] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg" [0047.957] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg.badday" [0047.957] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\blad6 4bfxrakmcly.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\blad6 4bfxrakmcly.jpg.badday"), dwFlags=0x1) returned 1 [0047.957] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\bLaD6 4BFxrAKmcLy.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.957] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.957] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.958] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.958] GetProcessHeap () returned 0x560000 [0047.958] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0047.958] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0047.958] lstrcmpiW (lpString1="Camera Roll", lpString2=".") returned 1 [0047.958] lstrcmpiW (lpString1="Camera Roll", lpString2="..") returned 1 [0047.958] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0047.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Camera Roll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.958] GetProcessHeap () returned 0x560000 [0047.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0047.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Camera Roll", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Camera Roll", lpUsedDefaultChar=0x0) returned 12 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0047.958] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0047.959] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0047.959] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0047.959] GetProcessHeap () returned 0x560000 [0047.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a138 [0047.959] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned 37 [0047.959] GetProcessHeap () returned 0x560000 [0047.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4c) returned 0x58e5d0 [0047.960] lstrcpyW (in: lpString1=0x58e5d0, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0047.960] GetProcessHeap () returned 0x560000 [0047.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.960] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85a6d60, ftCreationTime.dwHighDateTime=0x1d4c792, ftLastAccessTime.dwLowDateTime=0xa7d775a0, ftLastAccessTime.dwHighDateTime=0x1d4cb73, ftLastWriteTime.dwLowDateTime=0xa7d775a0, ftLastWriteTime.dwHighDateTime=0x1d4cb73, nFileSizeHigh=0x0, nFileSizeLow=0x4e35, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cJMsK5xHa.gif", cAlternateFileName="CJMSK5~1.GIF")) returned 1 [0047.960] lstrcmpiW (lpString1="cJMsK5xHa.gif", lpString2=".") returned 1 [0047.960] lstrcmpiW (lpString1="cJMsK5xHa.gif", lpString2="..") returned 1 [0047.960] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="cJMsK5xHa.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif") returned="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif" [0047.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cJMsK5xHa.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.960] GetProcessHeap () returned 0x560000 [0047.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0047.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cJMsK5xHa.gif", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cJMsK5xHa.gif", lpUsedDefaultChar=0x0) returned 14 [0047.960] lstrlenA (lpString="cJMsK5xHa.gif") returned 13 [0047.960] lstrlenA (lpString=".badday") returned 7 [0047.960] lstrlenA (lpString=".badday") returned 7 [0047.960] lstrlenA (lpString="cJMsK5xHa.gif") returned 13 [0047.960] lstrcmpiA (lpString1="xHa.gif", lpString2=".badday") returned 1 [0047.960] lstrcmpiW (lpString1="cJMsK5xHa.gif", lpString2="how_to_back_files.html") returned -1 [0047.960] lstrcmpiW (lpString1="cJMsK5xHa.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.960] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.960] lstrcmpiW (lpString1="cJMsK5xHa.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.960] GetProcessHeap () returned 0x560000 [0047.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d490 [0047.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\cjmsk5xha.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.960] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=20021) returned 1 [0047.960] GetProcessHeap () returned 0x560000 [0047.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.960] GetProcessHeap () returned 0x560000 [0047.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x589f20 [0047.960] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif") returned 38 [0047.961] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.961] GetProcessHeap () returned 0x560000 [0047.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.961] GetProcessHeap () returned 0x560000 [0047.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x58d0d8 [0047.961] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.961] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x58ea98) returned 1 [0047.961] CryptGenRandom (in: hProv=0x58ea98, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.961] CryptReleaseContext (hProv=0x58ea98, dwFlags=0x0) returned 1 [0047.961] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.961] GetProcessHeap () returned 0x560000 [0047.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x58ea98 [0047.961] lstrlenA (lpString="010001") returned 6 [0047.961] GetProcessHeap () returned 0x560000 [0047.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5850b0 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850b0 | out: hHeap=0x560000) returned 1 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cdf8 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586600 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585248 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e48 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585248 | out: hHeap=0x560000) returned 1 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0047.962] GetProcessHeap () returned 0x560000 [0047.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ef0 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c618 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ef0 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.963] GetProcessHeap () returned 0x560000 [0047.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.964] GetProcessHeap () returned 0x560000 [0047.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.965] GetProcessHeap () returned 0x560000 [0047.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.966] GetProcessHeap () returned 0x560000 [0047.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e48 | out: hHeap=0x560000) returned 1 [0047.967] GetProcessHeap () returned 0x560000 [0047.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cdf8 | out: hHeap=0x560000) returned 1 [0047.968] GetProcessHeap () returned 0x560000 [0047.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0047.968] GetProcessHeap () returned 0x560000 [0047.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0047.968] GetProcessHeap () returned 0x560000 [0047.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.968] GetProcessHeap () returned 0x560000 [0047.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.968] GetProcessHeap () returned 0x560000 [0047.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ea98 | out: hHeap=0x560000) returned 1 [0047.968] WriteFile (in: hFile=0x230, lpBuffer=0x58d0d8*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d0d8*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0047.971] GetProcessHeap () returned 0x560000 [0047.971] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d0d8, Size=0x30) returned 0x58d0d8 [0047.971] GetProcessHeap () returned 0x560000 [0047.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.971] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.971] GetProcessHeap () returned 0x560000 [0047.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4e40) returned 0x5a0420 [0047.971] ReadFile (in: hFile=0x230, lpBuffer=0x5a0420, nNumberOfBytesToRead=0x4e40, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesRead=0x24ad7e8*=0x4e40, lpOverlapped=0x0) returned 1 [0047.971] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.971] WriteFile (in: hFile=0x230, lpBuffer=0x5a0420*, nNumberOfBytesToWrite=0x4e40, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a0420*, lpNumberOfBytesWritten=0x24ad7e4*=0x4e40, lpOverlapped=0x0) returned 1 [0047.973] GetProcessHeap () returned 0x560000 [0047.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0420 | out: hHeap=0x560000) returned 1 [0047.974] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.974] WriteFile (in: hFile=0x230, lpBuffer=0x58d0d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d0d8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.975] CloseHandle (hObject=0x230) returned 1 [0047.977] GetProcessHeap () returned 0x560000 [0047.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d490 | out: hHeap=0x560000) returned 1 [0047.977] GetProcessHeap () returned 0x560000 [0047.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0047.977] GetProcessHeap () returned 0x560000 [0047.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0047.977] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif") returned="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif" [0047.977] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif.badday" [0047.977] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\cjmsk5xha.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\cjmsk5xha.gif.badday"), dwFlags=0x1) returned 1 [0047.977] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\cJMsK5xHa.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0047.977] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0047.977] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0047.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0047.977] GetProcessHeap () returned 0x560000 [0047.977] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.978] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecbab50, ftCreationTime.dwHighDateTime=0x1d4c716, ftLastAccessTime.dwLowDateTime=0xb51268b0, ftLastAccessTime.dwHighDateTime=0x1d4d3de, ftLastWriteTime.dwLowDateTime=0xb51268b0, ftLastWriteTime.dwHighDateTime=0x1d4d3de, nFileSizeHigh=0x0, nFileSizeLow=0xd8b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cv6gt0ON6Ix6QVk1.bmp", cAlternateFileName="CV6GT0~1.BMP")) returned 1 [0047.978] lstrcmpiW (lpString1="cv6gt0ON6Ix6QVk1.bmp", lpString2=".") returned 1 [0047.978] lstrcmpiW (lpString1="cv6gt0ON6Ix6QVk1.bmp", lpString2="..") returned 1 [0047.978] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="cv6gt0ON6Ix6QVk1.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp" [0047.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cv6gt0ON6Ix6QVk1.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0047.978] GetProcessHeap () returned 0x560000 [0047.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576ad8 [0047.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cv6gt0ON6Ix6QVk1.bmp", cchWideChar=-1, lpMultiByteStr=0x576ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cv6gt0ON6Ix6QVk1.bmp", lpUsedDefaultChar=0x0) returned 21 [0047.978] lstrlenA (lpString="cv6gt0ON6Ix6QVk1.bmp") returned 20 [0047.978] lstrlenA (lpString=".badday") returned 7 [0047.978] lstrlenA (lpString=".badday") returned 7 [0047.978] lstrlenA (lpString="cv6gt0ON6Ix6QVk1.bmp") returned 20 [0047.978] lstrcmpiA (lpString1="Vk1.bmp", lpString2=".badday") returned 1 [0047.978] lstrcmpiW (lpString1="cv6gt0ON6Ix6QVk1.bmp", lpString2="how_to_back_files.html") returned -1 [0047.978] lstrcmpiW (lpString1="cv6gt0ON6Ix6QVk1.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0047.978] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0047.978] lstrcmpiW (lpString1="cv6gt0ON6Ix6QVk1.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0047.978] GetProcessHeap () returned 0x560000 [0047.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0047.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cv6gt0on6ix6qvk1.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0047.978] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=55475) returned 1 [0047.978] GetProcessHeap () returned 0x560000 [0047.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0047.978] GetProcessHeap () returned 0x560000 [0047.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0047.978] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp") returned 45 [0047.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.978] GetProcessHeap () returned 0x560000 [0047.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0047.979] GetProcessHeap () returned 0x560000 [0047.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58d110 [0047.979] lstrlenA (lpString="rsa_encrypt") returned 11 [0047.979] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584830) returned 1 [0047.980] CryptGenRandom (in: hProv=0x584830, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0047.980] CryptReleaseContext (hProv=0x584830, dwFlags=0x0) returned 1 [0047.980] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0047.980] GetProcessHeap () returned 0x560000 [0047.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0047.980] lstrlenA (lpString="010001") returned 6 [0047.980] GetProcessHeap () returned 0x560000 [0047.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0047.980] GetProcessHeap () returned 0x560000 [0047.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e08 [0047.980] GetProcessHeap () returned 0x560000 [0047.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c858 [0047.980] GetProcessHeap () returned 0x560000 [0047.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e08 | out: hHeap=0x560000) returned 1 [0047.980] GetProcessHeap () returned 0x560000 [0047.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf58 [0047.980] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584b60 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b60 | out: hHeap=0x560000) returned 1 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e60 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c978 [0047.981] GetProcessHeap () returned 0x560000 [0047.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e60 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c978 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.982] GetProcessHeap () returned 0x560000 [0047.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.982] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.983] GetProcessHeap () returned 0x560000 [0047.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.984] GetProcessHeap () returned 0x560000 [0047.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.984] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.985] GetProcessHeap () returned 0x560000 [0047.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0047.986] GetProcessHeap () returned 0x560000 [0047.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0047.987] GetProcessHeap () returned 0x560000 [0047.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0047.987] GetProcessHeap () returned 0x560000 [0047.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0047.987] GetProcessHeap () returned 0x560000 [0047.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0047.987] WriteFile (in: hFile=0x230, lpBuffer=0x58d110*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d110*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0047.988] GetProcessHeap () returned 0x560000 [0047.988] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d110, Size=0x30) returned 0x58d110 [0047.989] GetProcessHeap () returned 0x560000 [0047.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0047.989] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.989] GetProcessHeap () returned 0x560000 [0047.989] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd8c0) returned 0x5a1428 [0047.989] ReadFile (in: hFile=0x230, lpBuffer=0x5a1428, nNumberOfBytesToRead=0xd8c0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesRead=0x24ad7e8*=0xd8c0, lpOverlapped=0x0) returned 1 [0047.990] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0047.990] WriteFile (in: hFile=0x230, lpBuffer=0x5a1428*, nNumberOfBytesToWrite=0xd8c0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesWritten=0x24ad7e4*=0xd8c0, lpOverlapped=0x0) returned 1 [0047.992] GetProcessHeap () returned 0x560000 [0047.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1428 | out: hHeap=0x560000) returned 1 [0047.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0047.993] WriteFile (in: hFile=0x230, lpBuffer=0x58d110*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d110*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0047.998] CloseHandle (hObject=0x230) returned 1 [0048.000] GetProcessHeap () returned 0x560000 [0048.000] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0048.000] GetProcessHeap () returned 0x560000 [0048.000] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.000] GetProcessHeap () returned 0x560000 [0048.000] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0048.000] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp" [0048.000] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp.badday" [0048.000] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cv6gt0on6ix6qvk1.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\cv6gt0on6ix6qvk1.bmp.badday"), dwFlags=0x1) returned 1 [0048.001] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\cv6gt0ON6Ix6QVk1.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.001] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.001] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.001] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.001] GetProcessHeap () returned 0x560000 [0048.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576ad8 | out: hHeap=0x560000) returned 1 [0048.001] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.001] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.001] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.001] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" [0048.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.001] GetProcessHeap () returned 0x560000 [0048.001] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0048.001] lstrlenA (lpString="desktop.ini") returned 11 [0048.001] lstrlenA (lpString=".badday") returned 7 [0048.001] lstrlenA (lpString=".badday") returned 7 [0048.001] lstrlenA (lpString="desktop.ini") returned 11 [0048.001] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0048.001] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0048.001] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.002] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.002] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.002] GetProcessHeap () returned 0x560000 [0048.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.002] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=504) returned 1 [0048.002] GetProcessHeap () returned 0x560000 [0048.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.002] GetProcessHeap () returned 0x560000 [0048.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584a50 [0048.002] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned 36 [0048.002] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.002] GetProcessHeap () returned 0x560000 [0048.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.002] GetProcessHeap () returned 0x560000 [0048.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x58d148 [0048.002] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.002] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x585138) returned 1 [0048.003] CryptGenRandom (in: hProv=0x585138, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.003] CryptReleaseContext (hProv=0x585138, dwFlags=0x0) returned 1 [0048.003] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0048.003] lstrlenA (lpString="010001") returned 6 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584478 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584478 | out: hHeap=0x560000) returned 1 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586ec0 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584b60 [0048.003] GetProcessHeap () returned 0x560000 [0048.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5870f0 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b60 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c7c8 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b60 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d88 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca98 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d88 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.004] GetProcessHeap () returned 0x560000 [0048.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.004] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.005] GetProcessHeap () returned 0x560000 [0048.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.006] GetProcessHeap () returned 0x560000 [0048.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.006] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.007] GetProcessHeap () returned 0x560000 [0048.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.008] GetProcessHeap () returned 0x560000 [0048.008] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.008] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b60 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.009] GetProcessHeap () returned 0x560000 [0048.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0048.009] WriteFile (in: hFile=0x230, lpBuffer=0x58d148*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d148*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0048.012] GetProcessHeap () returned 0x560000 [0048.012] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d148, Size=0x30) returned 0x58d148 [0048.012] GetProcessHeap () returned 0x560000 [0048.012] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.012] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.012] GetProcessHeap () returned 0x560000 [0048.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.012] ReadFile (in: hFile=0x230, lpBuffer=0x58a3b0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesRead=0x24ad7e8*=0x200, lpOverlapped=0x0) returned 1 [0048.013] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.013] WriteFile (in: hFile=0x230, lpBuffer=0x58a3b0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x200, lpOverlapped=0x0) returned 1 [0048.017] GetProcessHeap () returned 0x560000 [0048.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.017] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.017] WriteFile (in: hFile=0x230, lpBuffer=0x58d148*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d148*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.018] CloseHandle (hObject=0x230) returned 1 [0048.019] GetProcessHeap () returned 0x560000 [0048.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.019] GetProcessHeap () returned 0x560000 [0048.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.019] GetProcessHeap () returned 0x560000 [0048.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a50 | out: hHeap=0x560000) returned 1 [0048.019] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" [0048.019] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.badday" [0048.019] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0048.020] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.020] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.020] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.020] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.020] GetProcessHeap () returned 0x560000 [0048.020] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.020] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee19660, ftCreationTime.dwHighDateTime=0x1d4c872, ftLastAccessTime.dwLowDateTime=0x1f6ad630, ftLastAccessTime.dwHighDateTime=0x1d4ccd6, ftLastWriteTime.dwLowDateTime=0x1f6ad630, ftLastWriteTime.dwHighDateTime=0x1d4ccd6, nFileSizeHigh=0x0, nFileSizeLow=0xb1cd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dexFAA3X5.jpg", cAlternateFileName="DEXFAA~1.JPG")) returned 1 [0048.020] lstrcmpiW (lpString1="dexFAA3X5.jpg", lpString2=".") returned 1 [0048.020] lstrcmpiW (lpString1="dexFAA3X5.jpg", lpString2="..") returned 1 [0048.020] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="dexFAA3X5.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg" [0048.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dexFAA3X5.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.020] GetProcessHeap () returned 0x560000 [0048.020] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0048.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dexFAA3X5.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dexFAA3X5.jpg", lpUsedDefaultChar=0x0) returned 14 [0048.020] lstrlenA (lpString="dexFAA3X5.jpg") returned 13 [0048.020] lstrlenA (lpString=".badday") returned 7 [0048.020] lstrlenA (lpString=".badday") returned 7 [0048.020] lstrlenA (lpString="dexFAA3X5.jpg") returned 13 [0048.020] lstrcmpiA (lpString1="3X5.jpg", lpString2=".badday") returned 1 [0048.020] lstrcmpiW (lpString1="dexFAA3X5.jpg", lpString2="how_to_back_files.html") returned -1 [0048.020] lstrcmpiW (lpString1="dexFAA3X5.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.020] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.020] lstrcmpiW (lpString1="dexFAA3X5.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.020] GetProcessHeap () returned 0x560000 [0048.020] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0048.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dexfaa3x5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.021] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=45517) returned 1 [0048.021] GetProcessHeap () returned 0x560000 [0048.021] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.021] GetProcessHeap () returned 0x560000 [0048.021] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e90 [0048.021] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg") returned 38 [0048.021] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.021] GetProcessHeap () returned 0x560000 [0048.021] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.021] GetProcessHeap () returned 0x560000 [0048.021] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58d180 [0048.021] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.021] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584e08) returned 1 [0048.022] CryptGenRandom (in: hProv=0x584e08, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.022] CryptReleaseContext (hProv=0x584e08, dwFlags=0x0) returned 1 [0048.022] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584830 [0048.022] lstrlenA (lpString="010001") returned 6 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584610 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c978 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584610 | out: hHeap=0x560000) returned 1 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0048.022] GetProcessHeap () returned 0x560000 [0048.022] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0048.022] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e00 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589dd0 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bfe8 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589dd0 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.023] GetProcessHeap () returned 0x560000 [0048.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.023] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.024] GetProcessHeap () returned 0x560000 [0048.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.025] GetProcessHeap () returned 0x560000 [0048.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.026] GetProcessHeap () returned 0x560000 [0048.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.026] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.027] GetProcessHeap () returned 0x560000 [0048.027] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.027] GetProcessHeap () returned 0x560000 [0048.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e00 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c978 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.028] GetProcessHeap () returned 0x560000 [0048.028] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x560000) returned 1 [0048.028] WriteFile (in: hFile=0x230, lpBuffer=0x58d180*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d180*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.030] GetProcessHeap () returned 0x560000 [0048.030] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d180, Size=0x30) returned 0x58d180 [0048.030] GetProcessHeap () returned 0x560000 [0048.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.030] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.030] GetProcessHeap () returned 0x560000 [0048.030] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb1cd) returned 0x5a1428 [0048.032] ReadFile (in: hFile=0x230, lpBuffer=0x5a1428, nNumberOfBytesToRead=0xb1cd, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesRead=0x24ad7e8*=0xb1cd, lpOverlapped=0x0) returned 1 [0048.032] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.033] WriteFile (in: hFile=0x230, lpBuffer=0x5a1428*, nNumberOfBytesToWrite=0xb1cd, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesWritten=0x24ad7e4*=0xb1cd, lpOverlapped=0x0) returned 1 [0048.034] GetProcessHeap () returned 0x560000 [0048.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1428 | out: hHeap=0x560000) returned 1 [0048.035] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.035] WriteFile (in: hFile=0x230, lpBuffer=0x58d180*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d180*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.036] CloseHandle (hObject=0x230) returned 1 [0048.041] GetProcessHeap () returned 0x560000 [0048.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0048.041] GetProcessHeap () returned 0x560000 [0048.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.041] GetProcessHeap () returned 0x560000 [0048.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0048.041] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg" [0048.041] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg.badday" [0048.041] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dexfaa3x5.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\dexfaa3x5.jpg.badday"), dwFlags=0x1) returned 1 [0048.042] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\dexFAA3X5.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.042] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.042] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.042] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.042] GetProcessHeap () returned 0x560000 [0048.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.042] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaec347b0, ftCreationTime.dwHighDateTime=0x1d4cf4a, ftLastAccessTime.dwLowDateTime=0xbed42dd0, ftLastAccessTime.dwHighDateTime=0x1d4cb22, ftLastWriteTime.dwLowDateTime=0xbed42dd0, ftLastWriteTime.dwHighDateTime=0x1d4cb22, nFileSizeHigh=0x0, nFileSizeLow=0x5ae7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DKtTEXlFqyW.bmp", cAlternateFileName="DKTTEX~1.BMP")) returned 1 [0048.042] lstrcmpiW (lpString1="DKtTEXlFqyW.bmp", lpString2=".") returned 1 [0048.042] lstrcmpiW (lpString1="DKtTEXlFqyW.bmp", lpString2="..") returned 1 [0048.042] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="DKtTEXlFqyW.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp" [0048.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DKtTEXlFqyW.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.042] GetProcessHeap () returned 0x560000 [0048.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0048.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DKtTEXlFqyW.bmp", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DKtTEXlFqyW.bmp", lpUsedDefaultChar=0x0) returned 16 [0048.042] lstrlenA (lpString="DKtTEXlFqyW.bmp") returned 15 [0048.042] lstrlenA (lpString=".badday") returned 7 [0048.042] lstrlenA (lpString=".badday") returned 7 [0048.042] lstrlenA (lpString="DKtTEXlFqyW.bmp") returned 15 [0048.042] lstrcmpiA (lpString1="qyW.bmp", lpString2=".badday") returned 1 [0048.042] lstrcmpiW (lpString1="DKtTEXlFqyW.bmp", lpString2="how_to_back_files.html") returned -1 [0048.042] lstrcmpiW (lpString1="DKtTEXlFqyW.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.042] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.042] lstrcmpiW (lpString1="DKtTEXlFqyW.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.042] GetProcessHeap () returned 0x560000 [0048.042] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0048.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dkttexlfqyw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.043] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=23271) returned 1 [0048.043] GetProcessHeap () returned 0x560000 [0048.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.043] GetProcessHeap () returned 0x560000 [0048.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585138 [0048.043] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp") returned 40 [0048.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.043] GetProcessHeap () returned 0x560000 [0048.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.043] GetProcessHeap () returned 0x560000 [0048.043] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58d1b8 [0048.043] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.043] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584610) returned 1 [0048.043] CryptGenRandom (in: hProv=0x584610, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.043] CryptReleaseContext (hProv=0x584610, dwFlags=0x0) returned 1 [0048.044] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585248 [0048.044] lstrlenA (lpString="010001") returned 6 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5851c0 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851c0 | out: hHeap=0x560000) returned 1 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c588 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584720 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.044] GetProcessHeap () returned 0x560000 [0048.044] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589f08 [0048.044] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c7c8 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ec0 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c7c8 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ec0 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.045] GetProcessHeap () returned 0x560000 [0048.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.046] GetProcessHeap () returned 0x560000 [0048.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.047] GetProcessHeap () returned 0x560000 [0048.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.050] GetProcessHeap () returned 0x560000 [0048.050] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.051] GetProcessHeap () returned 0x560000 [0048.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.051] GetProcessHeap () returned 0x560000 [0048.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f08 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c588 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.052] GetProcessHeap () returned 0x560000 [0048.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.053] GetProcessHeap () returned 0x560000 [0048.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.053] GetProcessHeap () returned 0x560000 [0048.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585248 | out: hHeap=0x560000) returned 1 [0048.053] WriteFile (in: hFile=0x230, lpBuffer=0x58d1b8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d1b8*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0048.054] GetProcessHeap () returned 0x560000 [0048.054] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d1b8, Size=0x30) returned 0x58d1b8 [0048.054] GetProcessHeap () returned 0x560000 [0048.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.054] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.054] GetProcessHeap () returned 0x560000 [0048.054] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5af0) returned 0x5a1428 [0048.055] ReadFile (in: hFile=0x230, lpBuffer=0x5a1428, nNumberOfBytesToRead=0x5af0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesRead=0x24ad7e8*=0x5af0, lpOverlapped=0x0) returned 1 [0048.056] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.056] WriteFile (in: hFile=0x230, lpBuffer=0x5a1428*, nNumberOfBytesToWrite=0x5af0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesWritten=0x24ad7e4*=0x5af0, lpOverlapped=0x0) returned 1 [0048.057] GetProcessHeap () returned 0x560000 [0048.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1428 | out: hHeap=0x560000) returned 1 [0048.057] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.057] WriteFile (in: hFile=0x230, lpBuffer=0x58d1b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d1b8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.058] CloseHandle (hObject=0x230) returned 1 [0048.059] GetProcessHeap () returned 0x560000 [0048.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0048.059] GetProcessHeap () returned 0x560000 [0048.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.059] GetProcessHeap () returned 0x560000 [0048.059] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585138 | out: hHeap=0x560000) returned 1 [0048.059] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp" [0048.059] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp.badday" [0048.059] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dkttexlfqyw.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\dkttexlfqyw.bmp.badday"), dwFlags=0x1) returned 1 [0048.060] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\DKtTEXlFqyW.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.060] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.060] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.060] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.060] GetProcessHeap () returned 0x560000 [0048.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.060] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da55a0, ftCreationTime.dwHighDateTime=0x1d4ccc9, ftLastAccessTime.dwLowDateTime=0xc10f1b60, ftLastAccessTime.dwHighDateTime=0x1d4cf90, ftLastWriteTime.dwLowDateTime=0xc10f1b60, ftLastWriteTime.dwHighDateTime=0x1d4cf90, nFileSizeHigh=0x0, nFileSizeLow=0x12402, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dXGHsWw6Vo vuCA8a.png", cAlternateFileName="DXGHSW~1.PNG")) returned 1 [0048.060] lstrcmpiW (lpString1="dXGHsWw6Vo vuCA8a.png", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="dXGHsWw6Vo vuCA8a.png", lpString2="..") returned 1 [0048.060] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="dXGHsWw6Vo vuCA8a.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png") returned="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png" [0048.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dXGHsWw6Vo vuCA8a.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.060] GetProcessHeap () returned 0x560000 [0048.060] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576ad8 [0048.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dXGHsWw6Vo vuCA8a.png", cchWideChar=-1, lpMultiByteStr=0x576ad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dXGHsWw6Vo vuCA8a.png", lpUsedDefaultChar=0x0) returned 22 [0048.060] lstrlenA (lpString="dXGHsWw6Vo vuCA8a.png") returned 21 [0048.060] lstrlenA (lpString=".badday") returned 7 [0048.060] lstrlenA (lpString=".badday") returned 7 [0048.061] lstrlenA (lpString="dXGHsWw6Vo vuCA8a.png") returned 21 [0048.061] lstrcmpiA (lpString1="A8a.png", lpString2=".badday") returned 1 [0048.061] lstrcmpiW (lpString1="dXGHsWw6Vo vuCA8a.png", lpString2="how_to_back_files.html") returned -1 [0048.061] lstrcmpiW (lpString1="dXGHsWw6Vo vuCA8a.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.061] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.061] lstrcmpiW (lpString1="dXGHsWw6Vo vuCA8a.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.061] GetProcessHeap () returned 0x560000 [0048.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0048.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dxghsww6vo vuca8a.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.061] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=74754) returned 1 [0048.061] GetProcessHeap () returned 0x560000 [0048.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.061] GetProcessHeap () returned 0x560000 [0048.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584d80 [0048.061] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png") returned 46 [0048.061] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.061] GetProcessHeap () returned 0x560000 [0048.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.061] GetProcessHeap () returned 0x560000 [0048.061] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58d1f0 [0048.061] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.061] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584e08) returned 1 [0048.062] CryptGenRandom (in: hProv=0x584e08, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.062] CryptReleaseContext (hProv=0x584e08, dwFlags=0x0) returned 1 [0048.062] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5843f0 [0048.062] lstrlenA (lpString="010001") returned 6 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584500 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0048.062] GetProcessHeap () returned 0x560000 [0048.062] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.062] GetProcessHeap () returned 0x560000 [0048.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.063] GetProcessHeap () returned 0x560000 [0048.063] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0048.063] GetProcessHeap () returned 0x560000 [0048.063] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584478 [0048.063] GetProcessHeap () returned 0x560000 [0048.063] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0048.063] GetProcessHeap () returned 0x560000 [0048.063] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.063] GetProcessHeap () returned 0x560000 [0048.063] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.063] GetProcessHeap () returned 0x560000 [0048.064] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0048.064] GetProcessHeap () returned 0x560000 [0048.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584478 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ce0 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cbb8 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ce0 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.065] GetProcessHeap () returned 0x560000 [0048.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.066] GetProcessHeap () returned 0x560000 [0048.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.066] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.067] GetProcessHeap () returned 0x560000 [0048.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.068] GetProcessHeap () returned 0x560000 [0048.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.068] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.069] GetProcessHeap () returned 0x560000 [0048.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.070] GetProcessHeap () returned 0x560000 [0048.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843f0 | out: hHeap=0x560000) returned 1 [0048.070] WriteFile (in: hFile=0x230, lpBuffer=0x58d1f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d1f0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.072] GetProcessHeap () returned 0x560000 [0048.072] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d1f0, Size=0x30) returned 0x58d1f0 [0048.072] GetProcessHeap () returned 0x560000 [0048.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.072] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.072] GetProcessHeap () returned 0x560000 [0048.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12402) returned 0x5a1428 [0048.073] ReadFile (in: hFile=0x230, lpBuffer=0x5a1428, nNumberOfBytesToRead=0x12402, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesRead=0x24ad7e8*=0x12402, lpOverlapped=0x0) returned 1 [0048.074] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.074] WriteFile (in: hFile=0x230, lpBuffer=0x5a1428*, nNumberOfBytesToWrite=0x12402, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesWritten=0x24ad7e4*=0x12402, lpOverlapped=0x0) returned 1 [0048.075] GetProcessHeap () returned 0x560000 [0048.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1428 | out: hHeap=0x560000) returned 1 [0048.076] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.077] WriteFile (in: hFile=0x230, lpBuffer=0x58d1f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d1f0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.078] CloseHandle (hObject=0x230) returned 1 [0048.080] GetProcessHeap () returned 0x560000 [0048.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0048.080] GetProcessHeap () returned 0x560000 [0048.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.080] GetProcessHeap () returned 0x560000 [0048.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d80 | out: hHeap=0x560000) returned 1 [0048.080] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png") returned="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png" [0048.080] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png.badday" [0048.080] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dxghsww6vo vuca8a.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\dxghsww6vo vuca8a.png.badday"), dwFlags=0x1) returned 1 [0048.081] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\dXGHsWw6Vo vuCA8a.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.081] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.081] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.081] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.081] GetProcessHeap () returned 0x560000 [0048.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576ad8 | out: hHeap=0x560000) returned 1 [0048.081] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8067a530, ftCreationTime.dwHighDateTime=0x1d4cd9e, ftLastAccessTime.dwLowDateTime=0x98282bc0, ftLastAccessTime.dwHighDateTime=0x1d4c82d, ftLastWriteTime.dwLowDateTime=0x98282bc0, ftLastWriteTime.dwHighDateTime=0x1d4c82d, nFileSizeHigh=0x0, nFileSizeLow=0x11bd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eZf09N.bmp", cAlternateFileName="")) returned 1 [0048.081] lstrcmpiW (lpString1="eZf09N.bmp", lpString2=".") returned 1 [0048.081] lstrcmpiW (lpString1="eZf09N.bmp", lpString2="..") returned 1 [0048.081] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="eZf09N.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp" [0048.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eZf09N.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.081] GetProcessHeap () returned 0x560000 [0048.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0048.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eZf09N.bmp", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eZf09N.bmp", lpUsedDefaultChar=0x0) returned 11 [0048.081] lstrlenA (lpString="eZf09N.bmp") returned 10 [0048.081] lstrlenA (lpString=".badday") returned 7 [0048.081] lstrlenA (lpString=".badday") returned 7 [0048.081] lstrlenA (lpString="eZf09N.bmp") returned 10 [0048.081] lstrcmpiA (lpString1="09N.bmp", lpString2=".badday") returned 1 [0048.081] lstrcmpiW (lpString1="eZf09N.bmp", lpString2="how_to_back_files.html") returned -1 [0048.081] lstrcmpiW (lpString1="eZf09N.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.081] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.082] lstrcmpiW (lpString1="eZf09N.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.082] GetProcessHeap () returned 0x560000 [0048.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d328 [0048.082] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ezf09n.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.082] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=72657) returned 1 [0048.082] GetProcessHeap () returned 0x560000 [0048.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.082] GetProcessHeap () returned 0x560000 [0048.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584c70 [0048.082] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp") returned 35 [0048.082] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.082] GetProcessHeap () returned 0x560000 [0048.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.082] GetProcessHeap () returned 0x560000 [0048.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x58d228 [0048.082] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.082] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x585248) returned 1 [0048.083] CryptGenRandom (in: hProv=0x585248, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.083] CryptReleaseContext (hProv=0x585248, dwFlags=0x0) returned 1 [0048.083] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584f18 [0048.083] lstrlenA (lpString="010001") returned 6 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584830 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x560000) returned 1 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5849c8 [0048.083] GetProcessHeap () returned 0x560000 [0048.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0048.083] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d70 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c08 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c978 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c08 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c978 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.084] GetProcessHeap () returned 0x560000 [0048.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.085] GetProcessHeap () returned 0x560000 [0048.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.085] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.086] GetProcessHeap () returned 0x560000 [0048.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.086] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.087] GetProcessHeap () returned 0x560000 [0048.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.088] GetProcessHeap () returned 0x560000 [0048.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d70 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.089] GetProcessHeap () returned 0x560000 [0048.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x560000) returned 1 [0048.089] WriteFile (in: hFile=0x230, lpBuffer=0x58d228*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d228*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0048.091] GetProcessHeap () returned 0x560000 [0048.091] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d228, Size=0x30) returned 0x58d228 [0048.091] GetProcessHeap () returned 0x560000 [0048.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.091] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.091] GetProcessHeap () returned 0x560000 [0048.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11be0) returned 0x5a1428 [0048.093] ReadFile (in: hFile=0x230, lpBuffer=0x5a1428, nNumberOfBytesToRead=0x11be0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesRead=0x24ad7e8*=0x11be0, lpOverlapped=0x0) returned 1 [0048.094] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.094] WriteFile (in: hFile=0x230, lpBuffer=0x5a1428*, nNumberOfBytesToWrite=0x11be0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a1428*, lpNumberOfBytesWritten=0x24ad7e4*=0x11be0, lpOverlapped=0x0) returned 1 [0048.096] GetProcessHeap () returned 0x560000 [0048.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1428 | out: hHeap=0x560000) returned 1 [0048.096] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.096] WriteFile (in: hFile=0x230, lpBuffer=0x58d228*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d228*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.097] CloseHandle (hObject=0x230) returned 1 [0048.099] GetProcessHeap () returned 0x560000 [0048.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0048.100] GetProcessHeap () returned 0x560000 [0048.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.100] GetProcessHeap () returned 0x560000 [0048.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c70 | out: hHeap=0x560000) returned 1 [0048.100] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp" [0048.100] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp.badday" [0048.100] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ezf09n.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\ezf09n.bmp.badday"), dwFlags=0x1) returned 1 [0048.101] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\eZf09N.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.101] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.101] GetProcessHeap () returned 0x560000 [0048.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.101] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401e8040, ftCreationTime.dwHighDateTime=0x1d4c649, ftLastAccessTime.dwLowDateTime=0x57c85d90, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0x57c85d90, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0x6ea8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="finsyJVX7-2TP3 3Y0.bmp", cAlternateFileName="FINSYJ~1.BMP")) returned 1 [0048.101] lstrcmpiW (lpString1="finsyJVX7-2TP3 3Y0.bmp", lpString2=".") returned 1 [0048.101] lstrcmpiW (lpString1="finsyJVX7-2TP3 3Y0.bmp", lpString2="..") returned 1 [0048.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="finsyJVX7-2TP3 3Y0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp" [0048.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="finsyJVX7-2TP3 3Y0.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.101] GetProcessHeap () returned 0x560000 [0048.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576a58 [0048.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="finsyJVX7-2TP3 3Y0.bmp", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finsyJVX7-2TP3 3Y0.bmp", lpUsedDefaultChar=0x0) returned 23 [0048.101] lstrlenA (lpString="finsyJVX7-2TP3 3Y0.bmp") returned 22 [0048.101] lstrlenA (lpString=".badday") returned 7 [0048.101] lstrlenA (lpString=".badday") returned 7 [0048.101] lstrlenA (lpString="finsyJVX7-2TP3 3Y0.bmp") returned 22 [0048.101] lstrcmpiA (lpString1="3Y0.bmp", lpString2=".badday") returned 1 [0048.101] lstrcmpiW (lpString1="finsyJVX7-2TP3 3Y0.bmp", lpString2="how_to_back_files.html") returned -1 [0048.101] lstrcmpiW (lpString1="finsyJVX7-2TP3 3Y0.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.101] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.101] lstrcmpiW (lpString1="finsyJVX7-2TP3 3Y0.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.101] GetProcessHeap () returned 0x560000 [0048.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0048.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\finsyjvx7-2tp3 3y0.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.102] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=28328) returned 1 [0048.102] GetProcessHeap () returned 0x560000 [0048.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.102] GetProcessHeap () returned 0x560000 [0048.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584588 [0048.102] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp") returned 47 [0048.102] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.102] GetProcessHeap () returned 0x560000 [0048.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.102] GetProcessHeap () returned 0x560000 [0048.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59eb30 [0048.102] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.102] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5843f0) returned 1 [0048.102] CryptGenRandom (in: hProv=0x5843f0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.102] CryptReleaseContext (hProv=0x5843f0, dwFlags=0x0) returned 1 [0048.103] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584830 [0048.103] lstrlenA (lpString="010001") returned 6 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5851c0 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c588 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851c0 | out: hHeap=0x560000) returned 1 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c858 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5849c8 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.103] GetProcessHeap () returned 0x560000 [0048.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c7c8 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e90 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca08 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e90 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.104] GetProcessHeap () returned 0x560000 [0048.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.105] GetProcessHeap () returned 0x560000 [0048.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.106] GetProcessHeap () returned 0x560000 [0048.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.106] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.107] GetProcessHeap () returned 0x560000 [0048.107] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.108] GetProcessHeap () returned 0x560000 [0048.108] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c588 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.109] GetProcessHeap () returned 0x560000 [0048.109] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x560000) returned 1 [0048.109] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.113] GetProcessHeap () returned 0x560000 [0048.113] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59eb30, Size=0x30) returned 0x59eb30 [0048.113] GetProcessHeap () returned 0x560000 [0048.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.113] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.113] GetProcessHeap () returned 0x560000 [0048.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6ea8) returned 0x5a2430 [0048.114] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x6ea8, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x6ea8, lpOverlapped=0x0) returned 1 [0048.114] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.114] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x6ea8, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x6ea8, lpOverlapped=0x0) returned 1 [0048.115] GetProcessHeap () returned 0x560000 [0048.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.116] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.116] WriteFile (in: hFile=0x230, lpBuffer=0x59eb30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eb30*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.117] CloseHandle (hObject=0x230) returned 1 [0048.118] GetProcessHeap () returned 0x560000 [0048.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0048.119] GetProcessHeap () returned 0x560000 [0048.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.119] GetProcessHeap () returned 0x560000 [0048.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584588 | out: hHeap=0x560000) returned 1 [0048.119] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp" [0048.119] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp.badday" [0048.119] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\finsyjvx7-2tp3 3y0.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\finsyjvx7-2tp3 3y0.bmp.badday"), dwFlags=0x1) returned 1 [0048.119] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\finsyJVX7-2TP3 3Y0.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.119] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.119] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.119] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.119] GetProcessHeap () returned 0x560000 [0048.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0048.119] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679f5b30, ftCreationTime.dwHighDateTime=0x1d4d215, ftLastAccessTime.dwLowDateTime=0x7dd71020, ftLastAccessTime.dwHighDateTime=0x1d4ccaa, ftLastWriteTime.dwLowDateTime=0x7dd71020, ftLastWriteTime.dwHighDateTime=0x1d4ccaa, nFileSizeHigh=0x0, nFileSizeLow=0x146fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G ytLRAxWAyPUn1.gif", cAlternateFileName="GYTLRA~1.GIF")) returned 1 [0048.119] lstrcmpiW (lpString1="G ytLRAxWAyPUn1.gif", lpString2=".") returned 1 [0048.120] lstrcmpiW (lpString1="G ytLRAxWAyPUn1.gif", lpString2="..") returned 1 [0048.120] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="G ytLRAxWAyPUn1.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif") returned="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif" [0048.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G ytLRAxWAyPUn1.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0048.120] GetProcessHeap () returned 0x560000 [0048.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576b58 [0048.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G ytLRAxWAyPUn1.gif", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="G ytLRAxWAyPUn1.gif", lpUsedDefaultChar=0x0) returned 20 [0048.120] lstrlenA (lpString="G ytLRAxWAyPUn1.gif") returned 19 [0048.120] lstrlenA (lpString=".badday") returned 7 [0048.120] lstrlenA (lpString=".badday") returned 7 [0048.120] lstrlenA (lpString="G ytLRAxWAyPUn1.gif") returned 19 [0048.120] lstrcmpiA (lpString1="Un1.gif", lpString2=".badday") returned 1 [0048.120] lstrcmpiW (lpString1="G ytLRAxWAyPUn1.gif", lpString2="how_to_back_files.html") returned -1 [0048.120] lstrcmpiW (lpString1="G ytLRAxWAyPUn1.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.120] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.120] lstrcmpiW (lpString1="G ytLRAxWAyPUn1.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.120] GetProcessHeap () returned 0x560000 [0048.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d288 [0048.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\g ytlraxwaypun1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.120] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=83710) returned 1 [0048.120] GetProcessHeap () returned 0x560000 [0048.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.120] GetProcessHeap () returned 0x560000 [0048.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585248 [0048.120] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif") returned 44 [0048.120] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.120] GetProcessHeap () returned 0x560000 [0048.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.121] GetProcessHeap () returned 0x560000 [0048.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x59eb68 [0048.121] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.121] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584fa0) returned 1 [0048.121] CryptGenRandom (in: hProv=0x584fa0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.121] CryptReleaseContext (hProv=0x584fa0, dwFlags=0x0) returned 1 [0048.121] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.121] GetProcessHeap () returned 0x560000 [0048.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584cf8 [0048.121] lstrlenA (lpString="010001") returned 6 [0048.121] GetProcessHeap () returned 0x560000 [0048.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0048.121] GetProcessHeap () returned 0x560000 [0048.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0048.121] GetProcessHeap () returned 0x560000 [0048.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf58 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586830 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.122] GetProcessHeap () returned 0x560000 [0048.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e90 [0048.122] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c858 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e90 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.123] GetProcessHeap () returned 0x560000 [0048.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.124] GetProcessHeap () returned 0x560000 [0048.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.125] GetProcessHeap () returned 0x560000 [0048.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.126] GetProcessHeap () returned 0x560000 [0048.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0048.127] GetProcessHeap () returned 0x560000 [0048.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.128] GetProcessHeap () returned 0x560000 [0048.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0048.128] WriteFile (in: hFile=0x230, lpBuffer=0x59eb68*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eb68*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0048.130] GetProcessHeap () returned 0x560000 [0048.130] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59eb68, Size=0x30) returned 0x59eb68 [0048.130] GetProcessHeap () returned 0x560000 [0048.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.130] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.130] GetProcessHeap () returned 0x560000 [0048.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14700) returned 0x5a2430 [0048.132] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x14700, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x14700, lpOverlapped=0x0) returned 1 [0048.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.133] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x14700, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x14700, lpOverlapped=0x0) returned 1 [0048.135] GetProcessHeap () returned 0x560000 [0048.135] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.135] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.135] WriteFile (in: hFile=0x230, lpBuffer=0x59eb68*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eb68*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.136] CloseHandle (hObject=0x230) returned 1 [0048.138] GetProcessHeap () returned 0x560000 [0048.138] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d288 | out: hHeap=0x560000) returned 1 [0048.138] GetProcessHeap () returned 0x560000 [0048.138] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.138] GetProcessHeap () returned 0x560000 [0048.138] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585248 | out: hHeap=0x560000) returned 1 [0048.138] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif") returned="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif" [0048.138] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif.badday" [0048.138] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\g ytlraxwaypun1.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\g ytlraxwaypun1.gif.badday"), dwFlags=0x1) returned 1 [0048.138] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\G ytLRAxWAyPUn1.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.138] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.138] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.139] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.139] GetProcessHeap () returned 0x560000 [0048.139] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0048.139] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe680dd70, ftCreationTime.dwHighDateTime=0x1d4c879, ftLastAccessTime.dwLowDateTime=0xb6036c60, ftLastAccessTime.dwHighDateTime=0x1d4d302, ftLastWriteTime.dwLowDateTime=0xb6036c60, ftLastWriteTime.dwHighDateTime=0x1d4d302, nFileSizeHigh=0x0, nFileSizeLow=0x1151e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HC9iT3nap_mIne.gif", cAlternateFileName="HC9IT3~1.GIF")) returned 1 [0048.139] lstrcmpiW (lpString1="HC9iT3nap_mIne.gif", lpString2=".") returned 1 [0048.139] lstrcmpiW (lpString1="HC9iT3nap_mIne.gif", lpString2="..") returned 1 [0048.139] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HC9iT3nap_mIne.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif") returned="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif" [0048.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HC9iT3nap_mIne.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0048.139] GetProcessHeap () returned 0x560000 [0048.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576b58 [0048.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HC9iT3nap_mIne.gif", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HC9iT3nap_mIne.gif", lpUsedDefaultChar=0x0) returned 19 [0048.139] lstrlenA (lpString="HC9iT3nap_mIne.gif") returned 18 [0048.139] lstrlenA (lpString=".badday") returned 7 [0048.139] lstrlenA (lpString=".badday") returned 7 [0048.139] lstrlenA (lpString="HC9iT3nap_mIne.gif") returned 18 [0048.139] lstrcmpiA (lpString1="Ine.gif", lpString2=".badday") returned 1 [0048.139] lstrcmpiW (lpString1="HC9iT3nap_mIne.gif", lpString2="how_to_back_files.html") returned -1 [0048.139] lstrcmpiW (lpString1="HC9iT3nap_mIne.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.139] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.139] lstrcmpiW (lpString1="HC9iT3nap_mIne.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.139] GetProcessHeap () returned 0x560000 [0048.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0048.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\hc9it3nap_mine.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.139] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=70942) returned 1 [0048.139] GetProcessHeap () returned 0x560000 [0048.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.139] GetProcessHeap () returned 0x560000 [0048.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584720 [0048.140] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif") returned 43 [0048.140] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.140] GetProcessHeap () returned 0x560000 [0048.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.140] GetProcessHeap () returned 0x560000 [0048.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x59eba0 [0048.140] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.140] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5850b0) returned 1 [0048.140] CryptGenRandom (in: hProv=0x5850b0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.140] CryptReleaseContext (hProv=0x5850b0, dwFlags=0x0) returned 1 [0048.140] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.140] GetProcessHeap () returned 0x560000 [0048.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584d80 [0048.140] lstrlenA (lpString="010001") returned 6 [0048.140] GetProcessHeap () returned 0x560000 [0048.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584610 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca08 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584610 | out: hHeap=0x560000) returned 1 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587208 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584a50 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586b78 [0048.141] GetProcessHeap () returned 0x560000 [0048.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.141] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a50 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cf8 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bfe8 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cf8 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.142] GetProcessHeap () returned 0x560000 [0048.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.143] GetProcessHeap () returned 0x560000 [0048.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.144] GetProcessHeap () returned 0x560000 [0048.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.145] GetProcessHeap () returned 0x560000 [0048.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.146] GetProcessHeap () returned 0x560000 [0048.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.146] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.147] GetProcessHeap () returned 0x560000 [0048.147] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d80 | out: hHeap=0x560000) returned 1 [0048.147] WriteFile (in: hFile=0x230, lpBuffer=0x59eba0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eba0*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0048.148] GetProcessHeap () returned 0x560000 [0048.149] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59eba0, Size=0x30) returned 0x59eba0 [0048.149] GetProcessHeap () returned 0x560000 [0048.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.149] GetProcessHeap () returned 0x560000 [0048.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11520) returned 0x5a2430 [0048.149] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x11520, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x11520, lpOverlapped=0x0) returned 1 [0048.150] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.150] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x11520, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x11520, lpOverlapped=0x0) returned 1 [0048.151] GetProcessHeap () returned 0x560000 [0048.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.152] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.152] WriteFile (in: hFile=0x230, lpBuffer=0x59eba0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eba0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.153] CloseHandle (hObject=0x230) returned 1 [0048.155] GetProcessHeap () returned 0x560000 [0048.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0048.155] GetProcessHeap () returned 0x560000 [0048.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.155] GetProcessHeap () returned 0x560000 [0048.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0048.155] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif") returned="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif" [0048.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif.badday" [0048.156] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\hc9it3nap_mine.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\hc9it3nap_mine.gif.badday"), dwFlags=0x1) returned 1 [0048.156] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\HC9iT3nap_mIne.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.156] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.156] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.156] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.156] GetProcessHeap () returned 0x560000 [0048.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0048.156] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x922a71b0, ftCreationTime.dwHighDateTime=0x1d4c760, ftLastAccessTime.dwLowDateTime=0x51132760, ftLastAccessTime.dwHighDateTime=0x1d4d2cf, ftLastWriteTime.dwLowDateTime=0x51132760, ftLastWriteTime.dwHighDateTime=0x1d4d2cf, nFileSizeHigh=0x0, nFileSizeLow=0x59a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hfrEp4B.bmp", cAlternateFileName="")) returned 1 [0048.156] lstrcmpiW (lpString1="hfrEp4B.bmp", lpString2=".") returned 1 [0048.156] lstrcmpiW (lpString1="hfrEp4B.bmp", lpString2="..") returned 1 [0048.156] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="hfrEp4B.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp" [0048.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hfrEp4B.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.156] GetProcessHeap () returned 0x560000 [0048.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hfrEp4B.bmp", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hfrEp4B.bmp", lpUsedDefaultChar=0x0) returned 12 [0048.156] lstrlenA (lpString="hfrEp4B.bmp") returned 11 [0048.156] lstrlenA (lpString=".badday") returned 7 [0048.157] lstrlenA (lpString=".badday") returned 7 [0048.157] lstrlenA (lpString="hfrEp4B.bmp") returned 11 [0048.157] lstrcmpiA (lpString1="p4B.bmp", lpString2=".badday") returned 1 [0048.157] lstrcmpiW (lpString1="hfrEp4B.bmp", lpString2="how_to_back_files.html") returned -1 [0048.157] lstrcmpiW (lpString1="hfrEp4B.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.157] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.157] lstrcmpiW (lpString1="hfrEp4B.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.157] GetProcessHeap () returned 0x560000 [0048.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0048.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hfrep4b.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.157] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=22952) returned 1 [0048.157] GetProcessHeap () returned 0x560000 [0048.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.157] GetProcessHeap () returned 0x560000 [0048.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584368 [0048.157] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp") returned 36 [0048.157] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.157] GetProcessHeap () returned 0x560000 [0048.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.157] GetProcessHeap () returned 0x560000 [0048.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x59ebd8 [0048.158] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.158] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584e08) returned 1 [0048.158] CryptGenRandom (in: hProv=0x584e08, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.158] CryptReleaseContext (hProv=0x584e08, dwFlags=0x0) returned 1 [0048.158] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.158] GetProcessHeap () returned 0x560000 [0048.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585028 [0048.158] lstrlenA (lpString="010001") returned 6 [0048.158] GetProcessHeap () returned 0x560000 [0048.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.158] GetProcessHeap () returned 0x560000 [0048.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e08 [0048.158] GetProcessHeap () returned 0x560000 [0048.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c858 [0048.158] GetProcessHeap () returned 0x560000 [0048.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e08 | out: hHeap=0x560000) returned 1 [0048.158] GetProcessHeap () returned 0x560000 [0048.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584610 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b4e8 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c978 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584610 | out: hHeap=0x560000) returned 1 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c978 | out: hHeap=0x560000) returned 1 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b3f8 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.159] GetProcessHeap () returned 0x560000 [0048.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cdf8 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b3f8 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cdf8 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.160] GetProcessHeap () returned 0x560000 [0048.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.161] GetProcessHeap () returned 0x560000 [0048.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.162] GetProcessHeap () returned 0x560000 [0048.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.162] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.163] GetProcessHeap () returned 0x560000 [0048.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b4e8 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.164] GetProcessHeap () returned 0x560000 [0048.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.165] GetProcessHeap () returned 0x560000 [0048.165] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585028 | out: hHeap=0x560000) returned 1 [0048.165] WriteFile (in: hFile=0x230, lpBuffer=0x59ebd8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ebd8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0048.166] GetProcessHeap () returned 0x560000 [0048.166] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ebd8, Size=0x30) returned 0x59ebd8 [0048.166] GetProcessHeap () returned 0x560000 [0048.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.166] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.166] GetProcessHeap () returned 0x560000 [0048.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x59b0) returned 0x5a2430 [0048.168] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x59b0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x59b0, lpOverlapped=0x0) returned 1 [0048.169] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.169] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x59b0, lpOverlapped=0x0) returned 1 [0048.170] GetProcessHeap () returned 0x560000 [0048.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.170] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.170] WriteFile (in: hFile=0x230, lpBuffer=0x59ebd8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ebd8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.171] CloseHandle (hObject=0x230) returned 1 [0048.172] GetProcessHeap () returned 0x560000 [0048.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0048.173] GetProcessHeap () returned 0x560000 [0048.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.173] GetProcessHeap () returned 0x560000 [0048.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0048.173] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp" [0048.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp.badday" [0048.173] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hfrep4b.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\hfrep4b.bmp.badday"), dwFlags=0x1) returned 1 [0048.173] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\hfrEp4B.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.173] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.173] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.173] GetProcessHeap () returned 0x560000 [0048.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.173] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x477c18f0, ftCreationTime.dwHighDateTime=0x1d4d20d, ftLastAccessTime.dwLowDateTime=0x8172e770, ftLastAccessTime.dwHighDateTime=0x1d4cc9d, ftLastWriteTime.dwLowDateTime=0x8172e770, ftLastWriteTime.dwHighDateTime=0x1d4cc9d, nFileSizeHigh=0x0, nFileSizeLow=0xb325, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HP8XfCZ76P5IS2.jpg", cAlternateFileName="HP8XFC~1.JPG")) returned 1 [0048.173] lstrcmpiW (lpString1="HP8XfCZ76P5IS2.jpg", lpString2=".") returned 1 [0048.173] lstrcmpiW (lpString1="HP8XfCZ76P5IS2.jpg", lpString2="..") returned 1 [0048.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HP8XfCZ76P5IS2.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg" [0048.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HP8XfCZ76P5IS2.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0048.174] GetProcessHeap () returned 0x560000 [0048.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0048.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HP8XfCZ76P5IS2.jpg", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HP8XfCZ76P5IS2.jpg", lpUsedDefaultChar=0x0) returned 19 [0048.174] lstrlenA (lpString="HP8XfCZ76P5IS2.jpg") returned 18 [0048.174] lstrlenA (lpString=".badday") returned 7 [0048.174] lstrlenA (lpString=".badday") returned 7 [0048.174] lstrlenA (lpString="HP8XfCZ76P5IS2.jpg") returned 18 [0048.174] lstrcmpiA (lpString1="IS2.jpg", lpString2=".badday") returned 1 [0048.174] lstrcmpiW (lpString1="HP8XfCZ76P5IS2.jpg", lpString2="how_to_back_files.html") returned 1 [0048.174] lstrcmpiW (lpString1="HP8XfCZ76P5IS2.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.174] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.174] lstrcmpiW (lpString1="HP8XfCZ76P5IS2.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.174] GetProcessHeap () returned 0x560000 [0048.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0048.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hp8xfcz76p5is2.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.174] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=45861) returned 1 [0048.174] GetProcessHeap () returned 0x560000 [0048.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.174] GetProcessHeap () returned 0x560000 [0048.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584368 [0048.174] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg") returned 43 [0048.174] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.174] GetProcessHeap () returned 0x560000 [0048.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.175] GetProcessHeap () returned 0x560000 [0048.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58b710 [0048.175] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.175] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584c70) returned 1 [0048.175] CryptGenRandom (in: hProv=0x584c70, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.175] CryptReleaseContext (hProv=0x584c70, dwFlags=0x0) returned 1 [0048.175] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.175] GetProcessHeap () returned 0x560000 [0048.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0048.175] lstrlenA (lpString="010001") returned 6 [0048.175] GetProcessHeap () returned 0x560000 [0048.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0048.175] GetProcessHeap () returned 0x560000 [0048.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5848b8 [0048.175] GetProcessHeap () returned 0x560000 [0048.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfe8 [0048.175] GetProcessHeap () returned 0x560000 [0048.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848b8 | out: hHeap=0x560000) returned 1 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5850b0 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850b0 | out: hHeap=0x560000) returned 1 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b368 [0048.176] GetProcessHeap () returned 0x560000 [0048.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.176] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c858 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b368 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.177] GetProcessHeap () returned 0x560000 [0048.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.177] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.178] GetProcessHeap () returned 0x560000 [0048.178] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.178] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.179] GetProcessHeap () returned 0x560000 [0048.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.180] GetProcessHeap () returned 0x560000 [0048.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.180] GetProcessHeap () returned 0x560000 [0048.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.181] GetProcessHeap () returned 0x560000 [0048.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.182] GetProcessHeap () returned 0x560000 [0048.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.182] GetProcessHeap () returned 0x560000 [0048.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.182] GetProcessHeap () returned 0x560000 [0048.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.182] GetProcessHeap () returned 0x560000 [0048.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.182] GetProcessHeap () returned 0x560000 [0048.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0048.182] WriteFile (in: hFile=0x230, lpBuffer=0x58b710*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b710*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.184] GetProcessHeap () returned 0x560000 [0048.184] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b710, Size=0x30) returned 0x58b710 [0048.184] GetProcessHeap () returned 0x560000 [0048.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.185] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.185] GetProcessHeap () returned 0x560000 [0048.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb325) returned 0x5a2430 [0048.185] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xb325, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xb325, lpOverlapped=0x0) returned 1 [0048.186] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.186] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xb325, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xb325, lpOverlapped=0x0) returned 1 [0048.187] GetProcessHeap () returned 0x560000 [0048.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.188] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.189] WriteFile (in: hFile=0x230, lpBuffer=0x58b710*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b710*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.189] CloseHandle (hObject=0x230) returned 1 [0048.191] GetProcessHeap () returned 0x560000 [0048.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0048.191] GetProcessHeap () returned 0x560000 [0048.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.191] GetProcessHeap () returned 0x560000 [0048.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0048.191] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg" [0048.191] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg.badday" [0048.191] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hp8xfcz76p5is2.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\hp8xfcz76p5is2.jpg.badday"), dwFlags=0x1) returned 1 [0048.192] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\HP8XfCZ76P5IS2.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.192] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.192] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.192] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.192] GetProcessHeap () returned 0x560000 [0048.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0048.192] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b04f1e0, ftCreationTime.dwHighDateTime=0x1d4cc16, ftLastAccessTime.dwLowDateTime=0x5fdb27d0, ftLastAccessTime.dwHighDateTime=0x1d4ccfc, ftLastWriteTime.dwLowDateTime=0x5fdb27d0, ftLastWriteTime.dwHighDateTime=0x1d4ccfc, nFileSizeHigh=0x0, nFileSizeLow=0x10430, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Lr LCRY3Wt0.jpg", cAlternateFileName="LRLCRY~1.JPG")) returned 1 [0048.192] lstrcmpiW (lpString1="Lr LCRY3Wt0.jpg", lpString2=".") returned 1 [0048.192] lstrcmpiW (lpString1="Lr LCRY3Wt0.jpg", lpString2="..") returned 1 [0048.192] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Lr LCRY3Wt0.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg" [0048.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Lr LCRY3Wt0.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.192] GetProcessHeap () returned 0x560000 [0048.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0048.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Lr LCRY3Wt0.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lr LCRY3Wt0.jpg", lpUsedDefaultChar=0x0) returned 16 [0048.192] lstrlenA (lpString="Lr LCRY3Wt0.jpg") returned 15 [0048.192] lstrlenA (lpString=".badday") returned 7 [0048.192] lstrlenA (lpString=".badday") returned 7 [0048.192] lstrlenA (lpString="Lr LCRY3Wt0.jpg") returned 15 [0048.192] lstrcmpiA (lpString1="Wt0.jpg", lpString2=".badday") returned 1 [0048.192] lstrcmpiW (lpString1="Lr LCRY3Wt0.jpg", lpString2="how_to_back_files.html") returned 1 [0048.193] lstrcmpiW (lpString1="Lr LCRY3Wt0.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.193] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.193] lstrcmpiW (lpString1="Lr LCRY3Wt0.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.193] GetProcessHeap () returned 0x560000 [0048.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0048.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lr lcry3wt0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.193] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=66608) returned 1 [0048.193] GetProcessHeap () returned 0x560000 [0048.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.193] GetProcessHeap () returned 0x560000 [0048.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584610 [0048.193] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg") returned 40 [0048.193] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.193] GetProcessHeap () returned 0x560000 [0048.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.193] GetProcessHeap () returned 0x560000 [0048.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58b748 [0048.193] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.193] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584c70) returned 1 [0048.194] CryptGenRandom (in: hProv=0x584c70, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.194] CryptReleaseContext (hProv=0x584c70, dwFlags=0x0) returned 1 [0048.194] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585138 [0048.194] lstrlenA (lpString="010001") returned 6 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5851c0 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4f8 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851c0 | out: hHeap=0x560000) returned 1 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.194] GetProcessHeap () returned 0x560000 [0048.194] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584fa0 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b590 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fa0 | out: hHeap=0x560000) returned 1 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b4a0 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c108 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b4a0 | out: hHeap=0x560000) returned 1 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c108 | out: hHeap=0x560000) returned 1 [0048.195] GetProcessHeap () returned 0x560000 [0048.195] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.195] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.196] GetProcessHeap () returned 0x560000 [0048.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.197] GetProcessHeap () returned 0x560000 [0048.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.198] GetProcessHeap () returned 0x560000 [0048.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.198] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.199] GetProcessHeap () returned 0x560000 [0048.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b590 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.200] GetProcessHeap () returned 0x560000 [0048.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585138 | out: hHeap=0x560000) returned 1 [0048.200] WriteFile (in: hFile=0x230, lpBuffer=0x58b748*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b748*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.202] GetProcessHeap () returned 0x560000 [0048.202] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b748, Size=0x30) returned 0x58b748 [0048.202] GetProcessHeap () returned 0x560000 [0048.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.202] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.202] GetProcessHeap () returned 0x560000 [0048.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10430) returned 0x5a2430 [0048.204] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x10430, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x10430, lpOverlapped=0x0) returned 1 [0048.205] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.205] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x10430, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x10430, lpOverlapped=0x0) returned 1 [0048.207] GetProcessHeap () returned 0x560000 [0048.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.207] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.207] WriteFile (in: hFile=0x230, lpBuffer=0x58b748*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b748*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.208] CloseHandle (hObject=0x230) returned 1 [0048.210] GetProcessHeap () returned 0x560000 [0048.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0048.210] GetProcessHeap () returned 0x560000 [0048.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.210] GetProcessHeap () returned 0x560000 [0048.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584610 | out: hHeap=0x560000) returned 1 [0048.210] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg" [0048.210] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg.badday" [0048.210] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lr lcry3wt0.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\lr lcry3wt0.jpg.badday"), dwFlags=0x1) returned 1 [0048.211] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Lr LCRY3Wt0.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.211] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.211] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.211] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.211] GetProcessHeap () returned 0x560000 [0048.211] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.211] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c34daf0, ftCreationTime.dwHighDateTime=0x1d4c764, ftLastAccessTime.dwLowDateTime=0xcd4e1d00, ftLastAccessTime.dwHighDateTime=0x1d4cf0d, ftLastWriteTime.dwLowDateTime=0xcd4e1d00, ftLastWriteTime.dwHighDateTime=0x1d4cf0d, nFileSizeHigh=0x0, nFileSizeLow=0x10e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maBolnnEN.jpg", cAlternateFileName="MABOLN~1.JPG")) returned 1 [0048.211] lstrcmpiW (lpString1="maBolnnEN.jpg", lpString2=".") returned 1 [0048.211] lstrcmpiW (lpString1="maBolnnEN.jpg", lpString2="..") returned 1 [0048.211] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="maBolnnEN.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg" [0048.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="maBolnnEN.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.211] GetProcessHeap () returned 0x560000 [0048.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0048.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="maBolnnEN.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="maBolnnEN.jpg", lpUsedDefaultChar=0x0) returned 14 [0048.211] lstrlenA (lpString="maBolnnEN.jpg") returned 13 [0048.211] lstrlenA (lpString=".badday") returned 7 [0048.211] lstrlenA (lpString=".badday") returned 7 [0048.211] lstrlenA (lpString="maBolnnEN.jpg") returned 13 [0048.211] lstrcmpiA (lpString1="nEN.jpg", lpString2=".badday") returned 1 [0048.211] lstrcmpiW (lpString1="maBolnnEN.jpg", lpString2="how_to_back_files.html") returned 1 [0048.211] lstrcmpiW (lpString1="maBolnnEN.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.211] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.211] lstrcmpiW (lpString1="maBolnnEN.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.211] GetProcessHeap () returned 0x560000 [0048.211] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0048.211] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mabolnnen.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.212] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=4322) returned 1 [0048.212] GetProcessHeap () returned 0x560000 [0048.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.212] GetProcessHeap () returned 0x560000 [0048.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584940 [0048.212] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg") returned 38 [0048.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.212] GetProcessHeap () returned 0x560000 [0048.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.212] GetProcessHeap () returned 0x560000 [0048.212] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x59ec10 [0048.212] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.212] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x585248) returned 1 [0048.212] CryptGenRandom (in: hProv=0x585248, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.213] CryptReleaseContext (hProv=0x585248, dwFlags=0x0) returned 1 [0048.213] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584830 [0048.213] lstrlenA (lpString="010001") returned 6 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5849c8 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584368 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.213] GetProcessHeap () returned 0x560000 [0048.213] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b368 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b590 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c858 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b590 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.214] GetProcessHeap () returned 0x560000 [0048.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.215] GetProcessHeap () returned 0x560000 [0048.215] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.216] GetProcessHeap () returned 0x560000 [0048.216] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.217] GetProcessHeap () returned 0x560000 [0048.217] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.218] GetProcessHeap () returned 0x560000 [0048.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b368 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.219] GetProcessHeap () returned 0x560000 [0048.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x560000) returned 1 [0048.219] WriteFile (in: hFile=0x230, lpBuffer=0x59ec10*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ec10*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0048.223] GetProcessHeap () returned 0x560000 [0048.223] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ec10, Size=0x30) returned 0x59ec10 [0048.223] GetProcessHeap () returned 0x560000 [0048.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.223] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.224] GetProcessHeap () returned 0x560000 [0048.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10f0) returned 0x5a2430 [0048.224] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x10f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x10f0, lpOverlapped=0x0) returned 1 [0048.224] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.224] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x10f0, lpOverlapped=0x0) returned 1 [0048.225] GetProcessHeap () returned 0x560000 [0048.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.225] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.225] WriteFile (in: hFile=0x230, lpBuffer=0x59ec10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ec10*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.226] CloseHandle (hObject=0x230) returned 1 [0048.227] GetProcessHeap () returned 0x560000 [0048.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0048.227] GetProcessHeap () returned 0x560000 [0048.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.227] GetProcessHeap () returned 0x560000 [0048.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584940 | out: hHeap=0x560000) returned 1 [0048.227] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg" [0048.227] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg.badday" [0048.227] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mabolnnen.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\mabolnnen.jpg.badday"), dwFlags=0x1) returned 1 [0048.228] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\maBolnnEN.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.228] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.228] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.228] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.228] GetProcessHeap () returned 0x560000 [0048.228] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.228] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57ef1db0, ftCreationTime.dwHighDateTime=0x1d4cd60, ftLastAccessTime.dwLowDateTime=0x6b3df360, ftLastAccessTime.dwHighDateTime=0x1d4cdaf, ftLastWriteTime.dwLowDateTime=0x6b3df360, ftLastWriteTime.dwHighDateTime=0x1d4cdaf, nFileSizeHigh=0x0, nFileSizeLow=0xbe34, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N jzD oSs.jpg", cAlternateFileName="NJZDOS~1.JPG")) returned 1 [0048.228] lstrcmpiW (lpString1="N jzD oSs.jpg", lpString2=".") returned 1 [0048.228] lstrcmpiW (lpString1="N jzD oSs.jpg", lpString2="..") returned 1 [0048.228] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="N jzD oSs.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg" [0048.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="N jzD oSs.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.228] GetProcessHeap () returned 0x560000 [0048.228] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0048.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="N jzD oSs.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N jzD oSs.jpg", lpUsedDefaultChar=0x0) returned 14 [0048.228] lstrlenA (lpString="N jzD oSs.jpg") returned 13 [0048.228] lstrlenA (lpString=".badday") returned 7 [0048.228] lstrlenA (lpString=".badday") returned 7 [0048.228] lstrlenA (lpString="N jzD oSs.jpg") returned 13 [0048.228] lstrcmpiA (lpString1="oSs.jpg", lpString2=".badday") returned 1 [0048.228] lstrcmpiW (lpString1="N jzD oSs.jpg", lpString2="how_to_back_files.html") returned 1 [0048.228] lstrcmpiW (lpString1="N jzD oSs.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.228] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.228] lstrcmpiW (lpString1="N jzD oSs.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.228] GetProcessHeap () returned 0x560000 [0048.228] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0048.229] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\n jzd oss.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.229] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=48692) returned 1 [0048.229] GetProcessHeap () returned 0x560000 [0048.229] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.229] GetProcessHeap () returned 0x560000 [0048.229] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584fa0 [0048.229] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg") returned 38 [0048.229] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.229] GetProcessHeap () returned 0x560000 [0048.229] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.229] GetProcessHeap () returned 0x560000 [0048.229] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58b780 [0048.229] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.229] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584368) returned 1 [0048.230] CryptGenRandom (in: hProv=0x584368, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.230] CryptReleaseContext (hProv=0x584368, dwFlags=0x0) returned 1 [0048.230] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5849c8 [0048.230] lstrlenA (lpString="010001") returned 6 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584720 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584720 | out: hHeap=0x560000) returned 1 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585028 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0048.230] GetProcessHeap () returned 0x560000 [0048.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b4d0 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c618 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585028 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b578 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cdf8 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b578 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cdf8 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.231] GetProcessHeap () returned 0x560000 [0048.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.231] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.232] GetProcessHeap () returned 0x560000 [0048.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.233] GetProcessHeap () returned 0x560000 [0048.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.234] GetProcessHeap () returned 0x560000 [0048.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.235] GetProcessHeap () returned 0x560000 [0048.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.235] GetProcessHeap () returned 0x560000 [0048.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b4d0 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0048.236] GetProcessHeap () returned 0x560000 [0048.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.237] GetProcessHeap () returned 0x560000 [0048.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.237] GetProcessHeap () returned 0x560000 [0048.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0048.237] WriteFile (in: hFile=0x230, lpBuffer=0x58b780*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b780*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.239] GetProcessHeap () returned 0x560000 [0048.239] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b780, Size=0x30) returned 0x58b780 [0048.239] GetProcessHeap () returned 0x560000 [0048.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.239] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.239] GetProcessHeap () returned 0x560000 [0048.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xbe34) returned 0x5a2430 [0048.239] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xbe34, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xbe34, lpOverlapped=0x0) returned 1 [0048.239] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.240] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xbe34, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xbe34, lpOverlapped=0x0) returned 1 [0048.241] GetProcessHeap () returned 0x560000 [0048.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.241] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.241] WriteFile (in: hFile=0x230, lpBuffer=0x58b780*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b780*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.242] CloseHandle (hObject=0x230) returned 1 [0048.244] GetProcessHeap () returned 0x560000 [0048.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0048.244] GetProcessHeap () returned 0x560000 [0048.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.244] GetProcessHeap () returned 0x560000 [0048.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fa0 | out: hHeap=0x560000) returned 1 [0048.244] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg" [0048.244] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg.badday" [0048.244] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\n jzd oss.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\n jzd oss.jpg.badday"), dwFlags=0x1) returned 1 [0048.244] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\N jzD oSs.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.244] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.244] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.244] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.245] GetProcessHeap () returned 0x560000 [0048.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.245] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d2750, ftCreationTime.dwHighDateTime=0x1d4d40c, ftLastAccessTime.dwLowDateTime=0xa99c5ac0, ftLastAccessTime.dwHighDateTime=0x1d4c88c, ftLastWriteTime.dwLowDateTime=0xa99c5ac0, ftLastWriteTime.dwHighDateTime=0x1d4c88c, nFileSizeHigh=0x0, nFileSizeLow=0x7b84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Nc8HjJ.gif", cAlternateFileName="")) returned 1 [0048.245] lstrcmpiW (lpString1="Nc8HjJ.gif", lpString2=".") returned 1 [0048.245] lstrcmpiW (lpString1="Nc8HjJ.gif", lpString2="..") returned 1 [0048.245] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Nc8HjJ.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif" [0048.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Nc8HjJ.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.245] GetProcessHeap () returned 0x560000 [0048.245] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0048.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Nc8HjJ.gif", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nc8HjJ.gif", lpUsedDefaultChar=0x0) returned 11 [0048.245] lstrlenA (lpString="Nc8HjJ.gif") returned 10 [0048.245] lstrlenA (lpString=".badday") returned 7 [0048.245] lstrlenA (lpString=".badday") returned 7 [0048.245] lstrlenA (lpString="Nc8HjJ.gif") returned 10 [0048.245] lstrcmpiA (lpString1="HjJ.gif", lpString2=".badday") returned 1 [0048.245] lstrcmpiW (lpString1="Nc8HjJ.gif", lpString2="how_to_back_files.html") returned 1 [0048.245] lstrcmpiW (lpString1="Nc8HjJ.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.245] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.245] lstrcmpiW (lpString1="Nc8HjJ.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.245] GetProcessHeap () returned 0x560000 [0048.245] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0048.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\nc8hjj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.245] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=31620) returned 1 [0048.245] GetProcessHeap () returned 0x560000 [0048.245] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.245] GetProcessHeap () returned 0x560000 [0048.245] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0048.246] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif") returned 35 [0048.246] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.246] GetProcessHeap () returned 0x560000 [0048.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.246] GetProcessHeap () returned 0x560000 [0048.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59ec48 [0048.246] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.246] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5848b8) returned 1 [0048.246] CryptGenRandom (in: hProv=0x5848b8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.246] CryptReleaseContext (hProv=0x5848b8, dwFlags=0x0) returned 1 [0048.246] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.246] GetProcessHeap () returned 0x560000 [0048.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585138 [0048.246] lstrlenA (lpString="010001") returned 6 [0048.246] GetProcessHeap () returned 0x560000 [0048.246] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584b60 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b60 | out: hHeap=0x560000) returned 1 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584588 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b680 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584588 | out: hHeap=0x560000) returned 1 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0048.247] GetProcessHeap () returned 0x560000 [0048.247] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.247] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b6e0 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c738 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b6e0 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.248] GetProcessHeap () returned 0x560000 [0048.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.249] GetProcessHeap () returned 0x560000 [0048.249] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.250] GetProcessHeap () returned 0x560000 [0048.250] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.251] GetProcessHeap () returned 0x560000 [0048.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b680 | out: hHeap=0x560000) returned 1 [0048.252] GetProcessHeap () returned 0x560000 [0048.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.253] GetProcessHeap () returned 0x560000 [0048.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.253] GetProcessHeap () returned 0x560000 [0048.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.253] GetProcessHeap () returned 0x560000 [0048.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.253] GetProcessHeap () returned 0x560000 [0048.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.253] GetProcessHeap () returned 0x560000 [0048.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585138 | out: hHeap=0x560000) returned 1 [0048.253] WriteFile (in: hFile=0x230, lpBuffer=0x59ec48*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ec48*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.255] GetProcessHeap () returned 0x560000 [0048.255] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ec48, Size=0x30) returned 0x59ec48 [0048.255] GetProcessHeap () returned 0x560000 [0048.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.255] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.255] GetProcessHeap () returned 0x560000 [0048.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7b84) returned 0x5a2430 [0048.255] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x7b84, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x7b84, lpOverlapped=0x0) returned 1 [0048.256] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.256] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x7b84, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x7b84, lpOverlapped=0x0) returned 1 [0048.257] GetProcessHeap () returned 0x560000 [0048.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.258] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.258] WriteFile (in: hFile=0x230, lpBuffer=0x59ec48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ec48*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.259] CloseHandle (hObject=0x230) returned 1 [0048.260] GetProcessHeap () returned 0x560000 [0048.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0048.261] GetProcessHeap () returned 0x560000 [0048.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.261] GetProcessHeap () returned 0x560000 [0048.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0048.261] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif" [0048.261] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif.badday" [0048.261] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\nc8hjj.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\nc8hjj.gif.badday"), dwFlags=0x1) returned 1 [0048.261] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Nc8HjJ.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.261] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.261] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.261] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.261] GetProcessHeap () returned 0x560000 [0048.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.261] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x129d4470, ftCreationTime.dwHighDateTime=0x1d4c5eb, ftLastAccessTime.dwLowDateTime=0x3e438fc0, ftLastAccessTime.dwHighDateTime=0x1d4cc1d, ftLastWriteTime.dwLowDateTime=0x3e438fc0, ftLastWriteTime.dwHighDateTime=0x1d4cc1d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P4dujcYY.gif", cAlternateFileName="")) returned 1 [0048.261] lstrcmpiW (lpString1="P4dujcYY.gif", lpString2=".") returned 1 [0048.262] lstrcmpiW (lpString1="P4dujcYY.gif", lpString2="..") returned 1 [0048.262] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="P4dujcYY.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif") returned="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif" [0048.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P4dujcYY.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.262] GetProcessHeap () returned 0x560000 [0048.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0048.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P4dujcYY.gif", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P4dujcYY.gif", lpUsedDefaultChar=0x0) returned 13 [0048.262] lstrlenA (lpString="P4dujcYY.gif") returned 12 [0048.262] lstrlenA (lpString=".badday") returned 7 [0048.262] lstrlenA (lpString=".badday") returned 7 [0048.262] lstrlenA (lpString="P4dujcYY.gif") returned 12 [0048.262] lstrcmpiA (lpString1="cYY.gif", lpString2=".badday") returned 1 [0048.262] lstrcmpiW (lpString1="P4dujcYY.gif", lpString2="how_to_back_files.html") returned 1 [0048.262] lstrcmpiW (lpString1="P4dujcYY.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.262] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.262] lstrcmpiW (lpString1="P4dujcYY.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.262] GetProcessHeap () returned 0x560000 [0048.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0048.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\p4dujcyy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.262] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=7622) returned 1 [0048.262] GetProcessHeap () returned 0x560000 [0048.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.262] GetProcessHeap () returned 0x560000 [0048.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584500 [0048.262] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif") returned 37 [0048.262] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.262] GetProcessHeap () returned 0x560000 [0048.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.263] GetProcessHeap () returned 0x560000 [0048.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38a) returned 0x59ec80 [0048.263] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.263] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584e08) returned 1 [0048.263] CryptGenRandom (in: hProv=0x584e08, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.263] CryptReleaseContext (hProv=0x584e08, dwFlags=0x0) returned 1 [0048.263] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.263] GetProcessHeap () returned 0x560000 [0048.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e90 [0048.263] lstrlenA (lpString="010001") returned 6 [0048.263] GetProcessHeap () returned 0x560000 [0048.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0048.263] GetProcessHeap () returned 0x560000 [0048.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5850b0 [0048.263] GetProcessHeap () returned 0x560000 [0048.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cd68 [0048.263] GetProcessHeap () returned 0x560000 [0048.263] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850b0 | out: hHeap=0x560000) returned 1 [0048.263] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587438 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5850b0 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b4b8 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850b0 | out: hHeap=0x560000) returned 1 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58b458 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.264] GetProcessHeap () returned 0x560000 [0048.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cc48 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b458 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.265] GetProcessHeap () returned 0x560000 [0048.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.266] GetProcessHeap () returned 0x560000 [0048.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.267] GetProcessHeap () returned 0x560000 [0048.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.268] GetProcessHeap () returned 0x560000 [0048.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.268] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58b4b8 | out: hHeap=0x560000) returned 1 [0048.269] GetProcessHeap () returned 0x560000 [0048.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0048.270] GetProcessHeap () returned 0x560000 [0048.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.270] GetProcessHeap () returned 0x560000 [0048.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cd68 | out: hHeap=0x560000) returned 1 [0048.270] GetProcessHeap () returned 0x560000 [0048.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.270] GetProcessHeap () returned 0x560000 [0048.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.270] GetProcessHeap () returned 0x560000 [0048.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0048.270] WriteFile (in: hFile=0x230, lpBuffer=0x59ec80*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ec80*, lpNumberOfBytesWritten=0x24ad864*=0x38a, lpOverlapped=0x0) returned 1 [0048.272] GetProcessHeap () returned 0x560000 [0048.272] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ec80, Size=0x30) returned 0x59ec80 [0048.272] GetProcessHeap () returned 0x560000 [0048.272] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.272] GetProcessHeap () returned 0x560000 [0048.272] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1dd0) returned 0x5a2430 [0048.273] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x1dd0, lpOverlapped=0x0) returned 1 [0048.273] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.273] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x1dd0, lpOverlapped=0x0) returned 1 [0048.274] GetProcessHeap () returned 0x560000 [0048.274] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.274] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.274] WriteFile (in: hFile=0x230, lpBuffer=0x59ec80*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ec80*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.275] CloseHandle (hObject=0x230) returned 1 [0048.276] GetProcessHeap () returned 0x560000 [0048.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0048.276] GetProcessHeap () returned 0x560000 [0048.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.276] GetProcessHeap () returned 0x560000 [0048.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0048.276] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif") returned="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif" [0048.277] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif.badday" [0048.277] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\p4dujcyy.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\p4dujcyy.gif.badday"), dwFlags=0x1) returned 1 [0048.277] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\P4dujcYY.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.277] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.277] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.277] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.277] GetProcessHeap () returned 0x560000 [0048.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.277] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb944a250, ftCreationTime.dwHighDateTime=0x1d4ce9c, ftLastAccessTime.dwLowDateTime=0xf1917380, ftLastAccessTime.dwHighDateTime=0x1d4cdd0, ftLastWriteTime.dwLowDateTime=0xf1917380, ftLastWriteTime.dwHighDateTime=0x1d4cdd0, nFileSizeHigh=0x0, nFileSizeLow=0x686c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PNPW.gif", cAlternateFileName="")) returned 1 [0048.277] lstrcmpiW (lpString1="PNPW.gif", lpString2=".") returned 1 [0048.277] lstrcmpiW (lpString1="PNPW.gif", lpString2="..") returned 1 [0048.277] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="PNPW.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif") returned="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif" [0048.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PNPW.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.277] GetProcessHeap () returned 0x560000 [0048.277] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0048.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PNPW.gif", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PNPW.gif", lpUsedDefaultChar=0x0) returned 9 [0048.278] lstrlenA (lpString="PNPW.gif") returned 8 [0048.278] lstrlenA (lpString=".badday") returned 7 [0048.278] lstrlenA (lpString=".badday") returned 7 [0048.278] lstrlenA (lpString="PNPW.gif") returned 8 [0048.278] lstrcmpiA (lpString1="NPW.gif", lpString2=".badday") returned 1 [0048.278] lstrcmpiW (lpString1="PNPW.gif", lpString2="how_to_back_files.html") returned 1 [0048.278] lstrcmpiW (lpString1="PNPW.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.278] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.278] lstrcmpiW (lpString1="PNPW.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.278] GetProcessHeap () returned 0x560000 [0048.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0048.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pnpw.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.278] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=26732) returned 1 [0048.278] GetProcessHeap () returned 0x560000 [0048.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.278] GetProcessHeap () returned 0x560000 [0048.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584a50 [0048.278] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif") returned 33 [0048.278] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.278] GetProcessHeap () returned 0x560000 [0048.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.278] GetProcessHeap () returned 0x560000 [0048.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58b308 [0048.278] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.278] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5851c0) returned 1 [0048.279] CryptGenRandom (in: hProv=0x5851c0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.279] CryptReleaseContext (hProv=0x5851c0, dwFlags=0x0) returned 1 [0048.279] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0048.279] lstrlenA (lpString="010001") returned 6 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x587320 [0048.279] GetProcessHeap () returned 0x560000 [0048.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586a60 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c08 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bec8 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bec8 | out: hHeap=0x560000) returned 1 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c20 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cb28 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c20 | out: hHeap=0x560000) returned 1 [0048.280] GetProcessHeap () returned 0x560000 [0048.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.281] GetProcessHeap () returned 0x560000 [0048.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.282] GetProcessHeap () returned 0x560000 [0048.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.282] GetProcessHeap () returned 0x560000 [0048.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.283] GetProcessHeap () returned 0x560000 [0048.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.283] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.284] GetProcessHeap () returned 0x560000 [0048.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.284] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.285] GetProcessHeap () returned 0x560000 [0048.285] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c08 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.286] GetProcessHeap () returned 0x560000 [0048.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0048.286] WriteFile (in: hFile=0x230, lpBuffer=0x58b308*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b308*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.288] GetProcessHeap () returned 0x560000 [0048.288] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b308, Size=0x30) returned 0x58b308 [0048.288] GetProcessHeap () returned 0x560000 [0048.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.288] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.288] GetProcessHeap () returned 0x560000 [0048.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x686c) returned 0x5a2430 [0048.288] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x686c, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x686c, lpOverlapped=0x0) returned 1 [0048.289] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.289] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x686c, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x686c, lpOverlapped=0x0) returned 1 [0048.290] GetProcessHeap () returned 0x560000 [0048.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.291] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.291] WriteFile (in: hFile=0x230, lpBuffer=0x58b308*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b308*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.292] CloseHandle (hObject=0x230) returned 1 [0048.293] GetProcessHeap () returned 0x560000 [0048.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0048.293] GetProcessHeap () returned 0x560000 [0048.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.293] GetProcessHeap () returned 0x560000 [0048.294] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a50 | out: hHeap=0x560000) returned 1 [0048.294] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif") returned="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif" [0048.294] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif.badday" [0048.294] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pnpw.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\pnpw.gif.badday"), dwFlags=0x1) returned 1 [0048.294] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\PNPW.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.294] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.294] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.294] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.294] GetProcessHeap () returned 0x560000 [0048.294] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.294] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f4c240, ftCreationTime.dwHighDateTime=0x1d4cee5, ftLastAccessTime.dwLowDateTime=0x81f8fa00, ftLastAccessTime.dwHighDateTime=0x1d4c800, ftLastWriteTime.dwLowDateTime=0x81f8fa00, ftLastWriteTime.dwHighDateTime=0x1d4c800, nFileSizeHigh=0x0, nFileSizeLow=0x13d0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pWWfwCCuDNgZkszxR.gif", cAlternateFileName="PWWFWC~1.GIF")) returned 1 [0048.294] lstrcmpiW (lpString1="pWWfwCCuDNgZkszxR.gif", lpString2=".") returned 1 [0048.294] lstrcmpiW (lpString1="pWWfwCCuDNgZkszxR.gif", lpString2="..") returned 1 [0048.294] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="pWWfwCCuDNgZkszxR.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif") returned="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif" [0048.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pWWfwCCuDNgZkszxR.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.294] GetProcessHeap () returned 0x560000 [0048.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x5769f8 [0048.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pWWfwCCuDNgZkszxR.gif", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pWWfwCCuDNgZkszxR.gif", lpUsedDefaultChar=0x0) returned 22 [0048.295] lstrlenA (lpString="pWWfwCCuDNgZkszxR.gif") returned 21 [0048.295] lstrlenA (lpString=".badday") returned 7 [0048.295] lstrlenA (lpString=".badday") returned 7 [0048.295] lstrlenA (lpString="pWWfwCCuDNgZkszxR.gif") returned 21 [0048.295] lstrcmpiA (lpString1="zxR.gif", lpString2=".badday") returned 1 [0048.295] lstrcmpiW (lpString1="pWWfwCCuDNgZkszxR.gif", lpString2="how_to_back_files.html") returned 1 [0048.295] lstrcmpiW (lpString1="pWWfwCCuDNgZkszxR.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.295] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.295] lstrcmpiW (lpString1="pWWfwCCuDNgZkszxR.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.295] GetProcessHeap () returned 0x560000 [0048.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0048.295] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pwwfwccudngzkszxr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.295] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81166) returned 1 [0048.295] GetProcessHeap () returned 0x560000 [0048.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.295] GetProcessHeap () returned 0x560000 [0048.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f408 [0048.295] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif") returned 46 [0048.295] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.295] GetProcessHeap () returned 0x560000 [0048.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.295] GetProcessHeap () returned 0x560000 [0048.295] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58b340 [0048.295] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.296] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f7c0) returned 1 [0048.296] CryptGenRandom (in: hProv=0x59f7c0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.296] CryptReleaseContext (hProv=0x59f7c0, dwFlags=0x0) returned 1 [0048.296] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.296] GetProcessHeap () returned 0x560000 [0048.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fb78 [0048.296] lstrlenA (lpString="010001") returned 6 [0048.296] GetProcessHeap () returned 0x560000 [0048.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.296] GetProcessHeap () returned 0x560000 [0048.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f5a0 [0048.296] GetProcessHeap () returned 0x560000 [0048.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf58 [0048.296] GetProcessHeap () returned 0x560000 [0048.296] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5a0 | out: hHeap=0x560000) returned 1 [0048.296] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fc88 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586da8 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfe8 [0048.297] GetProcessHeap () returned 0x560000 [0048.297] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc88 | out: hHeap=0x560000) returned 1 [0048.297] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cc8 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bec8 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cc8 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586fd8 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bec8 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.298] GetProcessHeap () returned 0x560000 [0048.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.298] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.299] GetProcessHeap () returned 0x560000 [0048.299] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.299] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.300] GetProcessHeap () returned 0x560000 [0048.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.301] GetProcessHeap () returned 0x560000 [0048.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.302] GetProcessHeap () returned 0x560000 [0048.302] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.302] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.303] GetProcessHeap () returned 0x560000 [0048.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb78 | out: hHeap=0x560000) returned 1 [0048.303] WriteFile (in: hFile=0x230, lpBuffer=0x58b340*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b340*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.321] GetProcessHeap () returned 0x560000 [0048.321] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b340, Size=0x30) returned 0x58b340 [0048.321] GetProcessHeap () returned 0x560000 [0048.321] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.321] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.321] GetProcessHeap () returned 0x560000 [0048.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13d0e) returned 0x5a2430 [0048.323] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x13d0e, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x13d0e, lpOverlapped=0x0) returned 1 [0048.324] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.324] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x13d0e, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x13d0e, lpOverlapped=0x0) returned 1 [0048.326] GetProcessHeap () returned 0x560000 [0048.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.326] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.326] WriteFile (in: hFile=0x230, lpBuffer=0x58b340*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b340*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.327] CloseHandle (hObject=0x230) returned 1 [0048.330] GetProcessHeap () returned 0x560000 [0048.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0048.330] GetProcessHeap () returned 0x560000 [0048.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.330] GetProcessHeap () returned 0x560000 [0048.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0048.330] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif") returned="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif" [0048.330] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif.badday" [0048.330] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pwwfwccudngzkszxr.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\pwwfwccudngzkszxr.gif.badday"), dwFlags=0x1) returned 1 [0048.330] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\pWWfwCCuDNgZkszxR.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.330] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.330] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.330] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.330] GetProcessHeap () returned 0x560000 [0048.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0048.331] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2883e440, ftCreationTime.dwHighDateTime=0x1d4c7b4, ftLastAccessTime.dwLowDateTime=0xe3549870, ftLastAccessTime.dwHighDateTime=0x1d4ccc6, ftLastWriteTime.dwLowDateTime=0xe3549870, ftLastWriteTime.dwHighDateTime=0x1d4ccc6, nFileSizeHigh=0x0, nFileSizeLow=0xa61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="quS85jOlb7OtuRO2bX.bmp", cAlternateFileName="QUS85J~1.BMP")) returned 1 [0048.331] lstrcmpiW (lpString1="quS85jOlb7OtuRO2bX.bmp", lpString2=".") returned 1 [0048.331] lstrcmpiW (lpString1="quS85jOlb7OtuRO2bX.bmp", lpString2="..") returned 1 [0048.331] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="quS85jOlb7OtuRO2bX.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp" [0048.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="quS85jOlb7OtuRO2bX.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.331] GetProcessHeap () returned 0x560000 [0048.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576a58 [0048.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="quS85jOlb7OtuRO2bX.bmp", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="quS85jOlb7OtuRO2bX.bmp", lpUsedDefaultChar=0x0) returned 23 [0048.331] lstrlenA (lpString="quS85jOlb7OtuRO2bX.bmp") returned 22 [0048.331] lstrlenA (lpString=".badday") returned 7 [0048.331] lstrlenA (lpString=".badday") returned 7 [0048.331] lstrlenA (lpString="quS85jOlb7OtuRO2bX.bmp") returned 22 [0048.331] lstrcmpiA (lpString1="2bX.bmp", lpString2=".badday") returned 1 [0048.331] lstrcmpiW (lpString1="quS85jOlb7OtuRO2bX.bmp", lpString2="how_to_back_files.html") returned 1 [0048.331] lstrcmpiW (lpString1="quS85jOlb7OtuRO2bX.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.331] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.331] lstrcmpiW (lpString1="quS85jOlb7OtuRO2bX.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.331] GetProcessHeap () returned 0x560000 [0048.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0048.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qus85jolb7oturo2bx.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.331] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2657) returned 1 [0048.331] GetProcessHeap () returned 0x560000 [0048.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.331] GetProcessHeap () returned 0x560000 [0048.331] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a0150 [0048.331] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp") returned 47 [0048.332] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.332] GetProcessHeap () returned 0x560000 [0048.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.332] GetProcessHeap () returned 0x560000 [0048.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x58b378 [0048.332] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.332] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59ff30) returned 1 [0048.332] CryptGenRandom (in: hProv=0x59ff30, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.332] CryptReleaseContext (hProv=0x59ff30, dwFlags=0x0) returned 1 [0048.332] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.332] GetProcessHeap () returned 0x560000 [0048.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f7c0 [0048.332] lstrlenA (lpString="010001") returned 6 [0048.332] GetProcessHeap () returned 0x560000 [0048.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fc88 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4f8 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc88 | out: hHeap=0x560000) returned 1 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586fd8 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fa68 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa68 | out: hHeap=0x560000) returned 1 [0048.333] GetProcessHeap () returned 0x560000 [0048.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ed8 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cc48 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ed8 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.334] GetProcessHeap () returned 0x560000 [0048.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.334] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.335] GetProcessHeap () returned 0x560000 [0048.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.335] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.336] GetProcessHeap () returned 0x560000 [0048.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.336] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.337] GetProcessHeap () returned 0x560000 [0048.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.338] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.339] GetProcessHeap () returned 0x560000 [0048.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f7c0 | out: hHeap=0x560000) returned 1 [0048.339] WriteFile (in: hFile=0x230, lpBuffer=0x58b378*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b378*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0048.341] GetProcessHeap () returned 0x560000 [0048.341] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58b378, Size=0x30) returned 0x58b378 [0048.341] GetProcessHeap () returned 0x560000 [0048.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.341] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.341] GetProcessHeap () returned 0x560000 [0048.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa70) returned 0x5a2430 [0048.341] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xa70, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xa70, lpOverlapped=0x0) returned 1 [0048.341] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.341] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xa70, lpOverlapped=0x0) returned 1 [0048.342] GetProcessHeap () returned 0x560000 [0048.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.342] WriteFile (in: hFile=0x230, lpBuffer=0x58b378*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58b378*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.343] CloseHandle (hObject=0x230) returned 1 [0048.344] GetProcessHeap () returned 0x560000 [0048.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0048.344] GetProcessHeap () returned 0x560000 [0048.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.344] GetProcessHeap () returned 0x560000 [0048.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0150 | out: hHeap=0x560000) returned 1 [0048.344] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp" [0048.344] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp.badday" [0048.344] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qus85jolb7oturo2bx.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\qus85jolb7oturo2bx.bmp.badday"), dwFlags=0x1) returned 1 [0048.345] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\quS85jOlb7OtuRO2bX.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.345] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.345] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.345] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.345] GetProcessHeap () returned 0x560000 [0048.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0048.345] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5eb7e0, ftCreationTime.dwHighDateTime=0x1d4d439, ftLastAccessTime.dwLowDateTime=0xf01a05a0, ftLastAccessTime.dwHighDateTime=0x1d4cb26, ftLastWriteTime.dwLowDateTime=0xf01a05a0, ftLastWriteTime.dwHighDateTime=0x1d4cb26, nFileSizeHigh=0x0, nFileSizeLow=0x9e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="r5TUKzn.jpg", cAlternateFileName="")) returned 1 [0048.345] lstrcmpiW (lpString1="r5TUKzn.jpg", lpString2=".") returned 1 [0048.345] lstrcmpiW (lpString1="r5TUKzn.jpg", lpString2="..") returned 1 [0048.345] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="r5TUKzn.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg" [0048.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r5TUKzn.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.345] GetProcessHeap () returned 0x560000 [0048.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r5TUKzn.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r5TUKzn.jpg", lpUsedDefaultChar=0x0) returned 12 [0048.345] lstrlenA (lpString="r5TUKzn.jpg") returned 11 [0048.345] lstrlenA (lpString=".badday") returned 7 [0048.345] lstrlenA (lpString=".badday") returned 7 [0048.346] lstrlenA (lpString="r5TUKzn.jpg") returned 11 [0048.346] lstrcmpiA (lpString1="Kzn.jpg", lpString2=".badday") returned 1 [0048.346] lstrcmpiW (lpString1="r5TUKzn.jpg", lpString2="how_to_back_files.html") returned 1 [0048.346] lstrcmpiW (lpString1="r5TUKzn.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.346] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.346] lstrcmpiW (lpString1="r5TUKzn.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.346] GetProcessHeap () returned 0x560000 [0048.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0048.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\r5tukzn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.346] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2534) returned 1 [0048.346] GetProcessHeap () returned 0x560000 [0048.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.346] GetProcessHeap () returned 0x560000 [0048.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fc88 [0048.346] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg") returned 36 [0048.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.346] GetProcessHeap () returned 0x560000 [0048.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.346] GetProcessHeap () returned 0x560000 [0048.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38a) returned 0x59ecb8 [0048.346] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.346] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f7c0) returned 1 [0048.347] CryptGenRandom (in: hProv=0x59f7c0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.347] CryptReleaseContext (hProv=0x59f7c0, dwFlags=0x0) returned 1 [0048.347] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fb78 [0048.347] lstrlenA (lpString="010001") returned 6 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a01d8 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a01d8 | out: hHeap=0x560000) returned 1 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586da8 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.347] GetProcessHeap () returned 0x560000 [0048.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fd10 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586ec0 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d2d8 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca08 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd10 | out: hHeap=0x560000) returned 1 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d518 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ca08 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d518 | out: hHeap=0x560000) returned 1 [0048.348] GetProcessHeap () returned 0x560000 [0048.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca08 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.349] GetProcessHeap () returned 0x560000 [0048.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.349] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.350] GetProcessHeap () returned 0x560000 [0048.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.350] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.351] GetProcessHeap () returned 0x560000 [0048.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.351] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.352] GetProcessHeap () returned 0x560000 [0048.352] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d2d8 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0048.353] GetProcessHeap () returned 0x560000 [0048.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.354] GetProcessHeap () returned 0x560000 [0048.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb78 | out: hHeap=0x560000) returned 1 [0048.354] WriteFile (in: hFile=0x230, lpBuffer=0x59ecb8*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ecb8*, lpNumberOfBytesWritten=0x24ad864*=0x38a, lpOverlapped=0x0) returned 1 [0048.356] GetProcessHeap () returned 0x560000 [0048.356] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ecb8, Size=0x30) returned 0x59ecb8 [0048.356] GetProcessHeap () returned 0x560000 [0048.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.356] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.356] GetProcessHeap () returned 0x560000 [0048.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9f0) returned 0x5a2430 [0048.356] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x9f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x9f0, lpOverlapped=0x0) returned 1 [0048.357] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.357] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x9f0, lpOverlapped=0x0) returned 1 [0048.357] GetProcessHeap () returned 0x560000 [0048.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.358] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.358] WriteFile (in: hFile=0x230, lpBuffer=0x59ecb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ecb8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.358] CloseHandle (hObject=0x230) returned 1 [0048.360] GetProcessHeap () returned 0x560000 [0048.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0048.360] GetProcessHeap () returned 0x560000 [0048.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.362] GetProcessHeap () returned 0x560000 [0048.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc88 | out: hHeap=0x560000) returned 1 [0048.362] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg" [0048.362] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg.badday" [0048.362] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\r5tukzn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\r5tukzn.jpg.badday"), dwFlags=0x1) returned 1 [0048.363] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\r5TUKzn.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.363] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.363] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.363] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.363] GetProcessHeap () returned 0x560000 [0048.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.363] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc79e840, ftCreationTime.dwHighDateTime=0x1d4d19f, ftLastAccessTime.dwLowDateTime=0xd0551700, ftLastAccessTime.dwHighDateTime=0x1d4d224, ftLastWriteTime.dwLowDateTime=0xd0551700, ftLastWriteTime.dwHighDateTime=0x1d4d224, nFileSizeHigh=0x0, nFileSizeLow=0x14ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rS62yzPpzA9AKo62EeBB.jpg", cAlternateFileName="RS62YZ~1.JPG")) returned 1 [0048.363] lstrcmpiW (lpString1="rS62yzPpzA9AKo62EeBB.jpg", lpString2=".") returned 1 [0048.363] lstrcmpiW (lpString1="rS62yzPpzA9AKo62EeBB.jpg", lpString2="..") returned 1 [0048.363] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="rS62yzPpzA9AKo62EeBB.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg" [0048.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rS62yzPpzA9AKo62EeBB.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0048.363] GetProcessHeap () returned 0x560000 [0048.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d620 [0048.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rS62yzPpzA9AKo62EeBB.jpg", cchWideChar=-1, lpMultiByteStr=0x57d620, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rS62yzPpzA9AKo62EeBB.jpg", lpUsedDefaultChar=0x0) returned 25 [0048.363] lstrlenA (lpString="rS62yzPpzA9AKo62EeBB.jpg") returned 24 [0048.363] lstrlenA (lpString=".badday") returned 7 [0048.363] lstrlenA (lpString=".badday") returned 7 [0048.363] lstrlenA (lpString="rS62yzPpzA9AKo62EeBB.jpg") returned 24 [0048.364] lstrcmpiA (lpString1="eBB.jpg", lpString2=".badday") returned 1 [0048.364] lstrcmpiW (lpString1="rS62yzPpzA9AKo62EeBB.jpg", lpString2="how_to_back_files.html") returned 1 [0048.364] lstrcmpiW (lpString1="rS62yzPpzA9AKo62EeBB.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.364] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.364] lstrcmpiW (lpString1="rS62yzPpzA9AKo62EeBB.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.364] GetProcessHeap () returned 0x560000 [0048.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0048.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rs62yzppza9ako62eebb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.364] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=5356) returned 1 [0048.364] GetProcessHeap () returned 0x560000 [0048.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.364] GetProcessHeap () returned 0x560000 [0048.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59ffb8 [0048.364] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg") returned 49 [0048.364] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.364] GetProcessHeap () returned 0x560000 [0048.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.364] GetProcessHeap () returned 0x560000 [0048.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x58d668 [0048.364] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.364] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f7c0) returned 1 [0048.365] CryptGenRandom (in: hProv=0x59f7c0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.365] CryptReleaseContext (hProv=0x59f7c0, dwFlags=0x0) returned 1 [0048.365] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.365] lstrlenA (lpString="010001") returned 6 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fb78 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cdf8 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb78 | out: hHeap=0x560000) returned 1 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c618 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.365] GetProcessHeap () returned 0x560000 [0048.365] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59ff30 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587320 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cbb8 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff30 | out: hHeap=0x560000) returned 1 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d3b0 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c228 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d3b0 | out: hHeap=0x560000) returned 1 [0048.366] GetProcessHeap () returned 0x560000 [0048.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c228 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.367] GetProcessHeap () returned 0x560000 [0048.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.368] GetProcessHeap () returned 0x560000 [0048.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.369] GetProcessHeap () returned 0x560000 [0048.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.370] GetProcessHeap () returned 0x560000 [0048.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0048.371] GetProcessHeap () returned 0x560000 [0048.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0048.372] GetProcessHeap () returned 0x560000 [0048.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cdf8 | out: hHeap=0x560000) returned 1 [0048.372] GetProcessHeap () returned 0x560000 [0048.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0048.372] GetProcessHeap () returned 0x560000 [0048.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.372] GetProcessHeap () returned 0x560000 [0048.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.372] WriteFile (in: hFile=0x230, lpBuffer=0x58d668*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d668*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0048.373] GetProcessHeap () returned 0x560000 [0048.373] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d668, Size=0x30) returned 0x58d668 [0048.373] GetProcessHeap () returned 0x560000 [0048.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.373] GetProcessHeap () returned 0x560000 [0048.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14f0) returned 0x5a2430 [0048.374] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x14f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x14f0, lpOverlapped=0x0) returned 1 [0048.374] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.374] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x14f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x14f0, lpOverlapped=0x0) returned 1 [0048.375] GetProcessHeap () returned 0x560000 [0048.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.375] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.375] WriteFile (in: hFile=0x230, lpBuffer=0x58d668*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d668*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.377] CloseHandle (hObject=0x230) returned 1 [0048.378] GetProcessHeap () returned 0x560000 [0048.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0048.378] GetProcessHeap () returned 0x560000 [0048.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.378] GetProcessHeap () returned 0x560000 [0048.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffb8 | out: hHeap=0x560000) returned 1 [0048.378] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg" [0048.378] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg.badday" [0048.378] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rs62yzppza9ako62eebb.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\rs62yzppza9ako62eebb.jpg.badday"), dwFlags=0x1) returned 1 [0048.379] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\rS62yzPpzA9AKo62EeBB.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.379] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.379] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.379] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.379] GetProcessHeap () returned 0x560000 [0048.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.379] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0048.379] lstrcmpiW (lpString1="Saved Pictures", lpString2=".") returned 1 [0048.379] lstrcmpiW (lpString1="Saved Pictures", lpString2="..") returned 1 [0048.379] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0048.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.379] GetProcessHeap () returned 0x560000 [0048.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0048.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Pictures", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saved Pictures", lpUsedDefaultChar=0x0) returned 15 [0048.379] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.379] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0048.379] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0048.379] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0048.380] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.381] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0048.381] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0048.381] GetProcessHeap () returned 0x560000 [0048.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a148 [0048.381] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned 40 [0048.381] GetProcessHeap () returned 0x560000 [0048.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x52) returned 0x589d80 [0048.381] lstrcpyW (in: lpString1=0x589d80, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0048.381] GetProcessHeap () returned 0x560000 [0048.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.381] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd12080, ftCreationTime.dwHighDateTime=0x1d4c96e, ftLastAccessTime.dwLowDateTime=0xf8f85400, ftLastAccessTime.dwHighDateTime=0x1d4d4ff, ftLastWriteTime.dwLowDateTime=0xf8f85400, ftLastWriteTime.dwHighDateTime=0x1d4d4ff, nFileSizeHigh=0x0, nFileSizeLow=0xcc0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SJWECaoeRjTcoTVp.bmp", cAlternateFileName="SJWECA~1.BMP")) returned 1 [0048.381] lstrcmpiW (lpString1="SJWECaoeRjTcoTVp.bmp", lpString2=".") returned 1 [0048.381] lstrcmpiW (lpString1="SJWECaoeRjTcoTVp.bmp", lpString2="..") returned 1 [0048.381] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="SJWECaoeRjTcoTVp.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp" [0048.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SJWECaoeRjTcoTVp.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.381] GetProcessHeap () returned 0x560000 [0048.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x5769f8 [0048.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SJWECaoeRjTcoTVp.bmp", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SJWECaoeRjTcoTVp.bmp", lpUsedDefaultChar=0x0) returned 21 [0048.381] lstrlenA (lpString="SJWECaoeRjTcoTVp.bmp") returned 20 [0048.381] lstrlenA (lpString=".badday") returned 7 [0048.381] lstrlenA (lpString=".badday") returned 7 [0048.382] lstrlenA (lpString="SJWECaoeRjTcoTVp.bmp") returned 20 [0048.382] lstrcmpiA (lpString1="TVp.bmp", lpString2=".badday") returned 1 [0048.382] lstrcmpiW (lpString1="SJWECaoeRjTcoTVp.bmp", lpString2="how_to_back_files.html") returned 1 [0048.382] lstrcmpiW (lpString1="SJWECaoeRjTcoTVp.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.382] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.382] lstrcmpiW (lpString1="SJWECaoeRjTcoTVp.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.382] GetProcessHeap () returned 0x560000 [0048.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.382] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sjwecaoerjtcotvp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.382] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=52239) returned 1 [0048.382] GetProcessHeap () returned 0x560000 [0048.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.382] GetProcessHeap () returned 0x560000 [0048.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fa68 [0048.382] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp") returned 45 [0048.382] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.382] GetProcessHeap () returned 0x560000 [0048.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.382] GetProcessHeap () returned 0x560000 [0048.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x58d6a0 [0048.382] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.382] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59fe20) returned 1 [0048.383] CryptGenRandom (in: hProv=0x59fe20, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.383] CryptReleaseContext (hProv=0x59fe20, dwFlags=0x0) returned 1 [0048.383] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a0260 [0048.383] lstrlenA (lpString="010001") returned 6 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a01d8 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cd68 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a01d8 | out: hHeap=0x560000) returned 1 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf58 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1280 [0048.383] GetProcessHeap () returned 0x560000 [0048.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.383] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a02e8 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0560 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a02e8 | out: hHeap=0x560000) returned 1 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d458 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c4f8 [0048.384] GetProcessHeap () returned 0x560000 [0048.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d458 | out: hHeap=0x560000) returned 1 [0048.384] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.385] GetProcessHeap () returned 0x560000 [0048.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.386] GetProcessHeap () returned 0x560000 [0048.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.387] GetProcessHeap () returned 0x560000 [0048.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.387] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.388] GetProcessHeap () returned 0x560000 [0048.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0048.389] GetProcessHeap () returned 0x560000 [0048.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.390] GetProcessHeap () returned 0x560000 [0048.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cd68 | out: hHeap=0x560000) returned 1 [0048.390] GetProcessHeap () returned 0x560000 [0048.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.390] GetProcessHeap () returned 0x560000 [0048.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.390] GetProcessHeap () returned 0x560000 [0048.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0260 | out: hHeap=0x560000) returned 1 [0048.390] WriteFile (in: hFile=0x230, lpBuffer=0x58d6a0*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d6a0*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0048.392] GetProcessHeap () returned 0x560000 [0048.392] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d6a0, Size=0x30) returned 0x58d6a0 [0048.392] GetProcessHeap () returned 0x560000 [0048.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.392] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.392] GetProcessHeap () returned 0x560000 [0048.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xcc10) returned 0x5a2430 [0048.392] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xcc10, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xcc10, lpOverlapped=0x0) returned 1 [0048.393] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.393] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xcc10, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xcc10, lpOverlapped=0x0) returned 1 [0048.394] GetProcessHeap () returned 0x560000 [0048.394] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.394] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.394] WriteFile (in: hFile=0x230, lpBuffer=0x58d6a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d6a0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.395] CloseHandle (hObject=0x230) returned 1 [0048.397] GetProcessHeap () returned 0x560000 [0048.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.397] GetProcessHeap () returned 0x560000 [0048.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.397] GetProcessHeap () returned 0x560000 [0048.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa68 | out: hHeap=0x560000) returned 1 [0048.397] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp" [0048.397] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp.badday" [0048.397] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sjwecaoerjtcotvp.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\sjwecaoerjtcotvp.bmp.badday"), dwFlags=0x1) returned 1 [0048.397] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\SJWECaoeRjTcoTVp.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.397] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.398] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.398] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.398] GetProcessHeap () returned 0x560000 [0048.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0048.398] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x466d31a0, ftCreationTime.dwHighDateTime=0x1d4cb15, ftLastAccessTime.dwLowDateTime=0xedb0fcb0, ftLastAccessTime.dwHighDateTime=0x1d4cf8b, ftLastWriteTime.dwLowDateTime=0xedb0fcb0, ftLastWriteTime.dwHighDateTime=0x1d4cf8b, nFileSizeHigh=0x0, nFileSizeLow=0xbecb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOu61Emm.jpg", cAlternateFileName="")) returned 1 [0048.398] lstrcmpiW (lpString1="SOu61Emm.jpg", lpString2=".") returned 1 [0048.398] lstrcmpiW (lpString1="SOu61Emm.jpg", lpString2="..") returned 1 [0048.398] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="SOu61Emm.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg" [0048.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SOu61Emm.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.398] GetProcessHeap () returned 0x560000 [0048.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0048.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SOu61Emm.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SOu61Emm.jpg", lpUsedDefaultChar=0x0) returned 13 [0048.398] lstrlenA (lpString="SOu61Emm.jpg") returned 12 [0048.398] lstrlenA (lpString=".badday") returned 7 [0048.398] lstrlenA (lpString=".badday") returned 7 [0048.398] lstrlenA (lpString="SOu61Emm.jpg") returned 12 [0048.398] lstrcmpiA (lpString1="Emm.jpg", lpString2=".badday") returned 1 [0048.398] lstrcmpiW (lpString1="SOu61Emm.jpg", lpString2="how_to_back_files.html") returned 1 [0048.398] lstrcmpiW (lpString1="SOu61Emm.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.398] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.398] lstrcmpiW (lpString1="SOu61Emm.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.398] GetProcessHeap () returned 0x560000 [0048.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d490 [0048.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sou61emm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.398] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=48843) returned 1 [0048.398] GetProcessHeap () returned 0x560000 [0048.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.399] GetProcessHeap () returned 0x560000 [0048.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fa68 [0048.399] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg") returned 37 [0048.399] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.399] GetProcessHeap () returned 0x560000 [0048.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.399] GetProcessHeap () returned 0x560000 [0048.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58d6d8 [0048.399] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.399] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a0040) returned 1 [0048.399] CryptGenRandom (in: hProv=0x5a0040, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.399] CryptReleaseContext (hProv=0x5a0040, dwFlags=0x0) returned 1 [0048.399] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.399] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59ffb8 [0048.400] lstrlenA (lpString="010001") returned 6 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f848 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3d8 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f848 | out: hHeap=0x560000) returned 1 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c588 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1050 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1168 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d3c8 [0048.400] GetProcessHeap () returned 0x560000 [0048.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d560 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bfe8 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d560 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.401] GetProcessHeap () returned 0x560000 [0048.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.402] GetProcessHeap () returned 0x560000 [0048.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.402] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.403] GetProcessHeap () returned 0x560000 [0048.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.404] GetProcessHeap () returned 0x560000 [0048.404] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.405] GetProcessHeap () returned 0x560000 [0048.405] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d3c8 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c588 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3d8 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.406] GetProcessHeap () returned 0x560000 [0048.406] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffb8 | out: hHeap=0x560000) returned 1 [0048.406] WriteFile (in: hFile=0x230, lpBuffer=0x58d6d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d6d8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.408] GetProcessHeap () returned 0x560000 [0048.408] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d6d8, Size=0x30) returned 0x58d6d8 [0048.408] GetProcessHeap () returned 0x560000 [0048.408] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.408] GetProcessHeap () returned 0x560000 [0048.408] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xbecb) returned 0x5a2430 [0048.408] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xbecb, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xbecb, lpOverlapped=0x0) returned 1 [0048.409] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.409] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xbecb, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xbecb, lpOverlapped=0x0) returned 1 [0048.411] GetProcessHeap () returned 0x560000 [0048.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.412] WriteFile (in: hFile=0x230, lpBuffer=0x58d6d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d6d8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.413] CloseHandle (hObject=0x230) returned 1 [0048.415] GetProcessHeap () returned 0x560000 [0048.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d490 | out: hHeap=0x560000) returned 1 [0048.415] GetProcessHeap () returned 0x560000 [0048.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.415] GetProcessHeap () returned 0x560000 [0048.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa68 | out: hHeap=0x560000) returned 1 [0048.415] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg" [0048.415] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg.badday" [0048.415] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sou61emm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\sou61emm.jpg.badday"), dwFlags=0x1) returned 1 [0048.415] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\SOu61Emm.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.415] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.415] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.415] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.416] GetProcessHeap () returned 0x560000 [0048.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.416] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9b0d8a0, ftCreationTime.dwHighDateTime=0x1d4d358, ftLastAccessTime.dwLowDateTime=0x7a5b5ac0, ftLastAccessTime.dwHighDateTime=0x1d4d559, ftLastWriteTime.dwLowDateTime=0x7a5b5ac0, ftLastWriteTime.dwHighDateTime=0x1d4d559, nFileSizeHigh=0x0, nFileSizeLow=0xee58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TA87QKnQ4W.jpg", cAlternateFileName="TA87QK~1.JPG")) returned 1 [0048.416] lstrcmpiW (lpString1="TA87QKnQ4W.jpg", lpString2=".") returned 1 [0048.416] lstrcmpiW (lpString1="TA87QKnQ4W.jpg", lpString2="..") returned 1 [0048.416] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="TA87QKnQ4W.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg" [0048.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TA87QKnQ4W.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.416] GetProcessHeap () returned 0x560000 [0048.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0048.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TA87QKnQ4W.jpg", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TA87QKnQ4W.jpg", lpUsedDefaultChar=0x0) returned 15 [0048.416] lstrlenA (lpString="TA87QKnQ4W.jpg") returned 14 [0048.416] lstrlenA (lpString=".badday") returned 7 [0048.416] lstrlenA (lpString=".badday") returned 7 [0048.416] lstrlenA (lpString="TA87QKnQ4W.jpg") returned 14 [0048.416] lstrcmpiA (lpString1="Q4W.jpg", lpString2=".badday") returned 1 [0048.416] lstrcmpiW (lpString1="TA87QKnQ4W.jpg", lpString2="how_to_back_files.html") returned 1 [0048.416] lstrcmpiW (lpString1="TA87QKnQ4W.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.416] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.416] lstrcmpiW (lpString1="TA87QKnQ4W.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.416] GetProcessHeap () returned 0x560000 [0048.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ta87qknq4w.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.416] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=61016) returned 1 [0048.416] GetProcessHeap () returned 0x560000 [0048.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.416] GetProcessHeap () returned 0x560000 [0048.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a0260 [0048.416] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg") returned 39 [0048.417] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.417] GetProcessHeap () returned 0x560000 [0048.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.417] GetProcessHeap () returned 0x560000 [0048.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58d710 [0048.417] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.417] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59ff30) returned 1 [0048.417] CryptGenRandom (in: hProv=0x59ff30, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.417] CryptReleaseContext (hProv=0x59ff30, dwFlags=0x0) returned 1 [0048.417] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.417] GetProcessHeap () returned 0x560000 [0048.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fc88 [0048.417] lstrlenA (lpString="010001") returned 6 [0048.417] GetProcessHeap () returned 0x560000 [0048.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a0040 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0040 | out: hHeap=0x560000) returned 1 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c858 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0bf0 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59ff30 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d2a8 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff30 | out: hHeap=0x560000) returned 1 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0048.418] GetProcessHeap () returned 0x560000 [0048.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d560 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cc48 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d560 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.419] GetProcessHeap () returned 0x560000 [0048.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.420] GetProcessHeap () returned 0x560000 [0048.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.420] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.421] GetProcessHeap () returned 0x560000 [0048.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.422] GetProcessHeap () returned 0x560000 [0048.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.423] GetProcessHeap () returned 0x560000 [0048.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.423] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d2a8 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.424] GetProcessHeap () returned 0x560000 [0048.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc88 | out: hHeap=0x560000) returned 1 [0048.424] WriteFile (in: hFile=0x230, lpBuffer=0x58d710*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d710*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.427] GetProcessHeap () returned 0x560000 [0048.427] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d710, Size=0x30) returned 0x58d710 [0048.427] GetProcessHeap () returned 0x560000 [0048.427] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.427] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.427] GetProcessHeap () returned 0x560000 [0048.427] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xee58) returned 0x5a2430 [0048.429] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xee58, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xee58, lpOverlapped=0x0) returned 1 [0048.430] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.430] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xee58, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xee58, lpOverlapped=0x0) returned 1 [0048.431] GetProcessHeap () returned 0x560000 [0048.431] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.431] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.431] WriteFile (in: hFile=0x230, lpBuffer=0x58d710*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d710*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.432] CloseHandle (hObject=0x230) returned 1 [0048.434] GetProcessHeap () returned 0x560000 [0048.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.434] GetProcessHeap () returned 0x560000 [0048.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.434] GetProcessHeap () returned 0x560000 [0048.434] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0260 | out: hHeap=0x560000) returned 1 [0048.434] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg" [0048.434] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg.badday" [0048.434] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ta87qknq4w.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\ta87qknq4w.jpg.badday"), dwFlags=0x1) returned 1 [0048.435] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\TA87QKnQ4W.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.435] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.435] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.435] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.435] GetProcessHeap () returned 0x560000 [0048.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.435] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb689bfa0, ftCreationTime.dwHighDateTime=0x1d4c81b, ftLastAccessTime.dwLowDateTime=0xed5dca10, ftLastAccessTime.dwHighDateTime=0x1d4ca9d, ftLastWriteTime.dwLowDateTime=0xed5dca10, ftLastWriteTime.dwHighDateTime=0x1d4ca9d, nFileSizeHigh=0x0, nFileSizeLow=0x10c23, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tEUEPYba gybUS7y.jpg", cAlternateFileName="TEUEPY~1.JPG")) returned 1 [0048.435] lstrcmpiW (lpString1="tEUEPYba gybUS7y.jpg", lpString2=".") returned 1 [0048.435] lstrcmpiW (lpString1="tEUEPYba gybUS7y.jpg", lpString2="..") returned 1 [0048.435] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="tEUEPYba gybUS7y.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg" [0048.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tEUEPYba gybUS7y.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.435] GetProcessHeap () returned 0x560000 [0048.435] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576ad8 [0048.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tEUEPYba gybUS7y.jpg", cchWideChar=-1, lpMultiByteStr=0x576ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tEUEPYba gybUS7y.jpg", lpUsedDefaultChar=0x0) returned 21 [0048.435] lstrlenA (lpString="tEUEPYba gybUS7y.jpg") returned 20 [0048.435] lstrlenA (lpString=".badday") returned 7 [0048.435] lstrlenA (lpString=".badday") returned 7 [0048.435] lstrlenA (lpString="tEUEPYba gybUS7y.jpg") returned 20 [0048.436] lstrcmpiA (lpString1="S7y.jpg", lpString2=".badday") returned 1 [0048.436] lstrcmpiW (lpString1="tEUEPYba gybUS7y.jpg", lpString2="how_to_back_files.html") returned 1 [0048.436] lstrcmpiW (lpString1="tEUEPYba gybUS7y.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.436] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.436] lstrcmpiW (lpString1="tEUEPYba gybUS7y.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.436] GetProcessHeap () returned 0x560000 [0048.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0048.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\teuepyba gybus7y.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.436] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=68643) returned 1 [0048.436] GetProcessHeap () returned 0x560000 [0048.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.436] GetProcessHeap () returned 0x560000 [0048.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a01d8 [0048.436] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg") returned 45 [0048.436] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.436] GetProcessHeap () returned 0x560000 [0048.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.436] GetProcessHeap () returned 0x560000 [0048.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58d748 [0048.436] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.436] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59faf0) returned 1 [0048.437] CryptGenRandom (in: hProv=0x59faf0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.437] CryptReleaseContext (hProv=0x59faf0, dwFlags=0x0) returned 1 [0048.437] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.437] lstrlenA (lpString="010001") returned 6 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f6b0 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f6b0 | out: hHeap=0x560000) returned 1 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4f8 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0560 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.437] GetProcessHeap () returned 0x560000 [0048.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0048.437] GetProcessHeap () returned 0x560000 [0048.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f7c0 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f7c0 | out: hHeap=0x560000) returned 1 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d608 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.438] GetProcessHeap () returned 0x560000 [0048.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c7c8 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d608 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.439] GetProcessHeap () returned 0x560000 [0048.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.440] GetProcessHeap () returned 0x560000 [0048.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.441] GetProcessHeap () returned 0x560000 [0048.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.442] GetProcessHeap () returned 0x560000 [0048.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.442] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.443] GetProcessHeap () returned 0x560000 [0048.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0048.444] GetProcessHeap () returned 0x560000 [0048.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.444] GetProcessHeap () returned 0x560000 [0048.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0048.444] GetProcessHeap () returned 0x560000 [0048.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0048.444] GetProcessHeap () returned 0x560000 [0048.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.444] GetProcessHeap () returned 0x560000 [0048.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.444] WriteFile (in: hFile=0x230, lpBuffer=0x58d748*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d748*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0048.445] GetProcessHeap () returned 0x560000 [0048.445] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d748, Size=0x30) returned 0x58d748 [0048.446] GetProcessHeap () returned 0x560000 [0048.446] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.446] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.446] GetProcessHeap () returned 0x560000 [0048.446] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10c30) returned 0x5a2430 [0048.446] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x10c30, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x10c30, lpOverlapped=0x0) returned 1 [0048.447] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.447] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x10c30, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x10c30, lpOverlapped=0x0) returned 1 [0048.448] GetProcessHeap () returned 0x560000 [0048.448] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.449] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.450] WriteFile (in: hFile=0x230, lpBuffer=0x58d748*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d748*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.451] CloseHandle (hObject=0x230) returned 1 [0048.453] GetProcessHeap () returned 0x560000 [0048.453] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0048.453] GetProcessHeap () returned 0x560000 [0048.453] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.453] GetProcessHeap () returned 0x560000 [0048.453] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a01d8 | out: hHeap=0x560000) returned 1 [0048.453] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg" [0048.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg.badday" [0048.453] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\teuepyba gybus7y.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\teuepyba gybus7y.jpg.badday"), dwFlags=0x1) returned 1 [0048.453] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\tEUEPYba gybUS7y.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.453] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.454] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.454] GetProcessHeap () returned 0x560000 [0048.454] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576ad8 | out: hHeap=0x560000) returned 1 [0048.454] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7494b0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x1a92e070, ftLastAccessTime.dwHighDateTime=0x1d4d2f9, ftLastWriteTime.dwLowDateTime=0x1a92e070, ftLastWriteTime.dwHighDateTime=0x1d4d2f9, nFileSizeHigh=0x0, nFileSizeLow=0x18180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TXtBpVWOhL2pZXbXXN0.png", cAlternateFileName="TXTBPV~1.PNG")) returned 1 [0048.454] lstrcmpiW (lpString1="TXtBpVWOhL2pZXbXXN0.png", lpString2=".") returned 1 [0048.454] lstrcmpiW (lpString1="TXtBpVWOhL2pZXbXXN0.png", lpString2="..") returned 1 [0048.454] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="TXtBpVWOhL2pZXbXXN0.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png") returned="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png" [0048.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TXtBpVWOhL2pZXbXXN0.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.454] GetProcessHeap () returned 0x560000 [0048.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5769f8 [0048.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TXtBpVWOhL2pZXbXXN0.png", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TXtBpVWOhL2pZXbXXN0.png", lpUsedDefaultChar=0x0) returned 24 [0048.454] lstrlenA (lpString="TXtBpVWOhL2pZXbXXN0.png") returned 23 [0048.454] lstrlenA (lpString=".badday") returned 7 [0048.454] lstrlenA (lpString=".badday") returned 7 [0048.454] lstrlenA (lpString="TXtBpVWOhL2pZXbXXN0.png") returned 23 [0048.454] lstrcmpiA (lpString1="XN0.png", lpString2=".badday") returned 1 [0048.454] lstrcmpiW (lpString1="TXtBpVWOhL2pZXbXXN0.png", lpString2="how_to_back_files.html") returned 1 [0048.454] lstrcmpiW (lpString1="TXtBpVWOhL2pZXbXXN0.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.454] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.454] lstrcmpiW (lpString1="TXtBpVWOhL2pZXbXXN0.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.454] GetProcessHeap () returned 0x560000 [0048.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\txtbpvwohl2pzxbxxn0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.455] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=98688) returned 1 [0048.455] GetProcessHeap () returned 0x560000 [0048.455] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.455] GetProcessHeap () returned 0x560000 [0048.455] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.455] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png") returned 48 [0048.455] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.455] GetProcessHeap () returned 0x560000 [0048.455] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.455] GetProcessHeap () returned 0x560000 [0048.455] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x58d780 [0048.455] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.455] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a0260) returned 1 [0048.455] CryptGenRandom (in: hProv=0x5a0260, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.456] CryptReleaseContext (hProv=0x5a0260, dwFlags=0x0) returned 1 [0048.456] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fb78 [0048.456] lstrlenA (lpString="010001") returned 6 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f8d0 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfe8 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f8d0 | out: hHeap=0x560000) returned 1 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0f38 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a02e8 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0ad8 [0048.456] GetProcessHeap () returned 0x560000 [0048.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c108 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a02e8 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c108 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d3c8 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c198 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d3c8 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.457] GetProcessHeap () returned 0x560000 [0048.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.457] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.458] GetProcessHeap () returned 0x560000 [0048.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.458] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.459] GetProcessHeap () returned 0x560000 [0048.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.460] GetProcessHeap () returned 0x560000 [0048.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.460] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.461] GetProcessHeap () returned 0x560000 [0048.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.462] GetProcessHeap () returned 0x560000 [0048.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb78 | out: hHeap=0x560000) returned 1 [0048.462] WriteFile (in: hFile=0x230, lpBuffer=0x58d780*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d780*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.464] GetProcessHeap () returned 0x560000 [0048.464] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d780, Size=0x30) returned 0x58d780 [0048.464] GetProcessHeap () returned 0x560000 [0048.464] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.464] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.464] GetProcessHeap () returned 0x560000 [0048.464] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18180) returned 0x5a2430 [0048.467] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x18180, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x18180, lpOverlapped=0x0) returned 1 [0048.468] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.468] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x18180, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x18180, lpOverlapped=0x0) returned 1 [0048.470] GetProcessHeap () returned 0x560000 [0048.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.470] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.470] WriteFile (in: hFile=0x230, lpBuffer=0x58d780*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d780*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.471] CloseHandle (hObject=0x230) returned 1 [0048.473] GetProcessHeap () returned 0x560000 [0048.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.473] GetProcessHeap () returned 0x560000 [0048.473] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.473] GetProcessHeap () returned 0x560000 [0048.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.474] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png") returned="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png" [0048.474] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png.badday" [0048.474] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\txtbpvwohl2pzxbxxn0.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\txtbpvwohl2pzxbxxn0.png.badday"), dwFlags=0x1) returned 1 [0048.474] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\TXtBpVWOhL2pZXbXXN0.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.474] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.474] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.474] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.474] GetProcessHeap () returned 0x560000 [0048.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0048.475] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dcfd30, ftCreationTime.dwHighDateTime=0x1d4d521, ftLastAccessTime.dwLowDateTime=0xeb2770a0, ftLastAccessTime.dwHighDateTime=0x1d4ca72, ftLastWriteTime.dwLowDateTime=0xeb2770a0, ftLastWriteTime.dwHighDateTime=0x1d4ca72, nFileSizeHigh=0x0, nFileSizeLow=0x112af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xJfN.png", cAlternateFileName="")) returned 1 [0048.475] lstrcmpiW (lpString1="xJfN.png", lpString2=".") returned 1 [0048.475] lstrcmpiW (lpString1="xJfN.png", lpString2="..") returned 1 [0048.475] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="xJfN.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\xJfN.png") returned="C:\\Users\\FD1HVy\\Pictures\\xJfN.png" [0048.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xJfN.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.475] GetProcessHeap () returned 0x560000 [0048.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0048.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xJfN.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xJfN.png", lpUsedDefaultChar=0x0) returned 9 [0048.475] lstrlenA (lpString="xJfN.png") returned 8 [0048.475] lstrlenA (lpString=".badday") returned 7 [0048.475] lstrlenA (lpString=".badday") returned 7 [0048.475] lstrlenA (lpString="xJfN.png") returned 8 [0048.475] lstrcmpiA (lpString1="JfN.png", lpString2=".badday") returned 1 [0048.475] lstrcmpiW (lpString1="xJfN.png", lpString2="how_to_back_files.html") returned 1 [0048.475] lstrcmpiW (lpString1="xJfN.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.475] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.475] lstrcmpiW (lpString1="xJfN.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.475] GetProcessHeap () returned 0x560000 [0048.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0048.475] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xJfN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xjfn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.475] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=70319) returned 1 [0048.475] GetProcessHeap () returned 0x560000 [0048.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.475] GetProcessHeap () returned 0x560000 [0048.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fe20 [0048.475] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\xJfN.png") returned 33 [0048.475] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.475] GetProcessHeap () returned 0x560000 [0048.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.476] GetProcessHeap () returned 0x560000 [0048.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x59ecf0 [0048.476] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.476] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f518) returned 1 [0048.476] CryptGenRandom (in: hProv=0x59f518, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.476] CryptReleaseContext (hProv=0x59f518, dwFlags=0x0) returned 1 [0048.476] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.476] GetProcessHeap () returned 0x560000 [0048.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fb78 [0048.476] lstrlenA (lpString="010001") returned 6 [0048.476] GetProcessHeap () returned 0x560000 [0048.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.476] GetProcessHeap () returned 0x560000 [0048.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f8d0 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bfe8 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f8d0 | out: hHeap=0x560000) returned 1 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ccd8 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0bf0 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f628 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d590 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c588 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f628 | out: hHeap=0x560000) returned 1 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c588 | out: hHeap=0x560000) returned 1 [0048.477] GetProcessHeap () returned 0x560000 [0048.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.477] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d5a8 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cc48 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d5a8 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.478] GetProcessHeap () returned 0x560000 [0048.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.479] GetProcessHeap () returned 0x560000 [0048.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.479] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.480] GetProcessHeap () returned 0x560000 [0048.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.481] GetProcessHeap () returned 0x560000 [0048.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.482] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d590 | out: hHeap=0x560000) returned 1 [0048.483] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.483] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.483] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bfe8 | out: hHeap=0x560000) returned 1 [0048.483] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.483] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.483] GetProcessHeap () returned 0x560000 [0048.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb78 | out: hHeap=0x560000) returned 1 [0048.483] WriteFile (in: hFile=0x230, lpBuffer=0x59ecf0*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ecf0*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0048.484] GetProcessHeap () returned 0x560000 [0048.484] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ecf0, Size=0x30) returned 0x59ecf0 [0048.484] GetProcessHeap () returned 0x560000 [0048.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.485] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.485] GetProcessHeap () returned 0x560000 [0048.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x112b0) returned 0x5a2430 [0048.485] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x112b0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x112b0, lpOverlapped=0x0) returned 1 [0048.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.486] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x112b0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x112b0, lpOverlapped=0x0) returned 1 [0048.487] GetProcessHeap () returned 0x560000 [0048.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.489] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.489] WriteFile (in: hFile=0x230, lpBuffer=0x59ecf0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ecf0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.490] CloseHandle (hObject=0x230) returned 1 [0048.492] GetProcessHeap () returned 0x560000 [0048.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0048.492] GetProcessHeap () returned 0x560000 [0048.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.492] GetProcessHeap () returned 0x560000 [0048.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fe20 | out: hHeap=0x560000) returned 1 [0048.492] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\xJfN.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\xJfN.png") returned="C:\\Users\\FD1HVy\\Pictures\\xJfN.png" [0048.492] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\xJfN.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\xJfN.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\xJfN.png.badday" [0048.492] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xJfN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xjfn.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xJfN.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\xjfn.png.badday"), dwFlags=0x1) returned 1 [0048.493] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\xJfN.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.493] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.493] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.493] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.493] GetProcessHeap () returned 0x560000 [0048.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.493] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x288c0ae0, ftCreationTime.dwHighDateTime=0x1d4c5a1, ftLastAccessTime.dwLowDateTime=0x7496a880, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0x7496a880, ftLastWriteTime.dwHighDateTime=0x1d4d480, nFileSizeHigh=0x0, nFileSizeLow=0xb1a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YTV8jbaYql.bmp", cAlternateFileName="YTV8JB~1.BMP")) returned 1 [0048.493] lstrcmpiW (lpString1="YTV8jbaYql.bmp", lpString2=".") returned 1 [0048.493] lstrcmpiW (lpString1="YTV8jbaYql.bmp", lpString2="..") returned 1 [0048.493] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="YTV8jbaYql.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp" [0048.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YTV8jbaYql.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.493] GetProcessHeap () returned 0x560000 [0048.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0048.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YTV8jbaYql.bmp", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YTV8jbaYql.bmp", lpUsedDefaultChar=0x0) returned 15 [0048.493] lstrlenA (lpString="YTV8jbaYql.bmp") returned 14 [0048.493] lstrlenA (lpString=".badday") returned 7 [0048.493] lstrlenA (lpString=".badday") returned 7 [0048.493] lstrlenA (lpString="YTV8jbaYql.bmp") returned 14 [0048.493] lstrcmpiA (lpString1="Yql.bmp", lpString2=".badday") returned 1 [0048.493] lstrcmpiW (lpString1="YTV8jbaYql.bmp", lpString2="how_to_back_files.html") returned 1 [0048.493] lstrcmpiW (lpString1="YTV8jbaYql.bmp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.493] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.493] lstrcmpiW (lpString1="YTV8jbaYql.bmp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.493] GetProcessHeap () returned 0x560000 [0048.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0048.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ytv8jbayql.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.494] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=45475) returned 1 [0048.494] GetProcessHeap () returned 0x560000 [0048.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.494] GetProcessHeap () returned 0x560000 [0048.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.494] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp") returned 39 [0048.494] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.494] GetProcessHeap () returned 0x560000 [0048.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.494] GetProcessHeap () returned 0x560000 [0048.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59ed28 [0048.494] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.494] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f848) returned 1 [0048.494] CryptGenRandom (in: hProv=0x59f848, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.495] CryptReleaseContext (hProv=0x59f848, dwFlags=0x0) returned 1 [0048.495] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fa68 [0048.495] lstrlenA (lpString="010001") returned 6 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fd98 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bec8 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a08a8 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0678 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.495] GetProcessHeap () returned 0x560000 [0048.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d3b0 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c618 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d428 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c7c8 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d428 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c7c8 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.496] GetProcessHeap () returned 0x560000 [0048.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.496] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.497] GetProcessHeap () returned 0x560000 [0048.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.498] GetProcessHeap () returned 0x560000 [0048.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.498] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.499] GetProcessHeap () returned 0x560000 [0048.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.499] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.500] GetProcessHeap () returned 0x560000 [0048.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d3b0 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bec8 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.501] GetProcessHeap () returned 0x560000 [0048.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa68 | out: hHeap=0x560000) returned 1 [0048.501] WriteFile (in: hFile=0x230, lpBuffer=0x59ed28*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ed28*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.503] GetProcessHeap () returned 0x560000 [0048.503] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ed28, Size=0x30) returned 0x59ed28 [0048.503] GetProcessHeap () returned 0x560000 [0048.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.503] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.503] GetProcessHeap () returned 0x560000 [0048.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb1a3) returned 0x5a2430 [0048.505] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xb1a3, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xb1a3, lpOverlapped=0x0) returned 1 [0048.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.506] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xb1a3, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xb1a3, lpOverlapped=0x0) returned 1 [0048.507] GetProcessHeap () returned 0x560000 [0048.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.507] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.507] WriteFile (in: hFile=0x230, lpBuffer=0x59ed28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ed28*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.508] CloseHandle (hObject=0x230) returned 1 [0048.509] GetProcessHeap () returned 0x560000 [0048.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0048.509] GetProcessHeap () returned 0x560000 [0048.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.510] GetProcessHeap () returned 0x560000 [0048.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.510] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp" [0048.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp.badday") returned="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp.badday" [0048.510] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ytv8jbayql.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\ytv8jbayql.bmp.badday"), dwFlags=0x1) returned 1 [0048.510] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\YTV8jbaYql.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.510] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.510] GetProcessHeap () returned 0x560000 [0048.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.510] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d8a700, ftCreationTime.dwHighDateTime=0x1d4ca58, ftLastAccessTime.dwLowDateTime=0x8bd9f80, ftLastAccessTime.dwHighDateTime=0x1d4d528, ftLastWriteTime.dwLowDateTime=0x8bd9f80, ftLastWriteTime.dwHighDateTime=0x1d4d528, nFileSizeHigh=0x0, nFileSizeLow=0xd714, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZdIADFpA.png", cAlternateFileName="")) returned 1 [0048.510] lstrcmpiW (lpString1="ZdIADFpA.png", lpString2=".") returned 1 [0048.510] lstrcmpiW (lpString1="ZdIADFpA.png", lpString2="..") returned 1 [0048.511] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="ZdIADFpA.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png") returned="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png" [0048.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZdIADFpA.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.511] GetProcessHeap () returned 0x560000 [0048.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0048.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZdIADFpA.png", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZdIADFpA.png", lpUsedDefaultChar=0x0) returned 13 [0048.511] lstrlenA (lpString="ZdIADFpA.png") returned 12 [0048.511] lstrlenA (lpString=".badday") returned 7 [0048.511] lstrlenA (lpString=".badday") returned 7 [0048.511] lstrlenA (lpString="ZdIADFpA.png") returned 12 [0048.511] lstrcmpiA (lpString1="FpA.png", lpString2=".badday") returned 1 [0048.511] lstrcmpiW (lpString1="ZdIADFpA.png", lpString2="how_to_back_files.html") returned 1 [0048.511] lstrcmpiW (lpString1="ZdIADFpA.png", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.511] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.511] lstrcmpiW (lpString1="ZdIADFpA.png", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.511] GetProcessHeap () returned 0x560000 [0048.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zdiadfpa.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.511] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=55060) returned 1 [0048.511] GetProcessHeap () returned 0x560000 [0048.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.511] GetProcessHeap () returned 0x560000 [0048.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f9e0 [0048.511] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png") returned 37 [0048.511] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.511] GetProcessHeap () returned 0x560000 [0048.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.511] GetProcessHeap () returned 0x560000 [0048.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x59ed60 [0048.512] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.512] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59ff30) returned 1 [0048.512] CryptGenRandom (in: hProv=0x59ff30, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.512] CryptReleaseContext (hProv=0x59ff30, dwFlags=0x0) returned 1 [0048.512] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.512] GetProcessHeap () returned 0x560000 [0048.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f738 [0048.512] lstrlenA (lpString="010001") returned 6 [0048.512] GetProcessHeap () returned 0x560000 [0048.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.512] GetProcessHeap () returned 0x560000 [0048.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fd98 [0048.512] GetProcessHeap () returned 0x560000 [0048.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0048.512] GetProcessHeap () returned 0x560000 [0048.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0ad8 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f8d0 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a08a8 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d308 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c3d8 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f8d0 | out: hHeap=0x560000) returned 1 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3d8 | out: hHeap=0x560000) returned 1 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d530 [0048.513] GetProcessHeap () returned 0x560000 [0048.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c198 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d530 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.514] GetProcessHeap () returned 0x560000 [0048.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.514] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.515] GetProcessHeap () returned 0x560000 [0048.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.516] GetProcessHeap () returned 0x560000 [0048.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.517] GetProcessHeap () returned 0x560000 [0048.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.518] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d308 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.519] GetProcessHeap () returned 0x560000 [0048.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f738 | out: hHeap=0x560000) returned 1 [0048.519] WriteFile (in: hFile=0x230, lpBuffer=0x59ed60*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ed60*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0048.525] GetProcessHeap () returned 0x560000 [0048.525] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ed60, Size=0x30) returned 0x59ed60 [0048.525] GetProcessHeap () returned 0x560000 [0048.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.525] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.525] GetProcessHeap () returned 0x560000 [0048.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd720) returned 0x5a2430 [0048.525] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0xd720, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0xd720, lpOverlapped=0x0) returned 1 [0048.526] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.526] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0xd720, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0xd720, lpOverlapped=0x0) returned 1 [0048.527] GetProcessHeap () returned 0x560000 [0048.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.528] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.528] WriteFile (in: hFile=0x230, lpBuffer=0x59ed60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ed60*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.529] CloseHandle (hObject=0x230) returned 1 [0048.538] GetProcessHeap () returned 0x560000 [0048.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.538] GetProcessHeap () returned 0x560000 [0048.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.538] GetProcessHeap () returned 0x560000 [0048.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f9e0 | out: hHeap=0x560000) returned 1 [0048.538] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png") returned="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png" [0048.538] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png.badday") returned="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png.badday" [0048.538] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zdiadfpa.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\zdiadfpa.png.badday"), dwFlags=0x1) returned 1 [0048.540] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\ZdIADFpA.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.540] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.540] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.540] GetProcessHeap () returned 0x560000 [0048.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.540] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5601f200, ftCreationTime.dwHighDateTime=0x1d4ce84, ftLastAccessTime.dwLowDateTime=0x2d5a7030, ftLastAccessTime.dwHighDateTime=0x1d4d144, ftLastWriteTime.dwLowDateTime=0x2d5a7030, ftLastWriteTime.dwHighDateTime=0x1d4d144, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zkrbWP75zE7SN_NI.gif", cAlternateFileName="ZKRBWP~1.GIF")) returned 1 [0048.540] lstrcmpiW (lpString1="zkrbWP75zE7SN_NI.gif", lpString2=".") returned 1 [0048.540] lstrcmpiW (lpString1="zkrbWP75zE7SN_NI.gif", lpString2="..") returned 1 [0048.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="zkrbWP75zE7SN_NI.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif") returned="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif" [0048.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zkrbWP75zE7SN_NI.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.540] GetProcessHeap () returned 0x560000 [0048.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x5769f8 [0048.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zkrbWP75zE7SN_NI.gif", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zkrbWP75zE7SN_NI.gif", lpUsedDefaultChar=0x0) returned 21 [0048.540] lstrlenA (lpString="zkrbWP75zE7SN_NI.gif") returned 20 [0048.540] lstrlenA (lpString=".badday") returned 7 [0048.540] lstrlenA (lpString=".badday") returned 7 [0048.540] lstrlenA (lpString="zkrbWP75zE7SN_NI.gif") returned 20 [0048.540] lstrcmpiA (lpString1="_NI.gif", lpString2=".badday") returned 1 [0048.540] lstrcmpiW (lpString1="zkrbWP75zE7SN_NI.gif", lpString2="how_to_back_files.html") returned 1 [0048.540] lstrcmpiW (lpString1="zkrbWP75zE7SN_NI.gif", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.540] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.540] lstrcmpiW (lpString1="zkrbWP75zE7SN_NI.gif", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.540] GetProcessHeap () returned 0x560000 [0048.540] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0048.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zkrbwp75ze7sn_ni.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.541] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=72785) returned 1 [0048.541] GetProcessHeap () returned 0x560000 [0048.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.541] GetProcessHeap () returned 0x560000 [0048.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f408 [0048.541] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif") returned 45 [0048.541] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.541] GetProcessHeap () returned 0x560000 [0048.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.541] GetProcessHeap () returned 0x560000 [0048.541] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x59ed98 [0048.541] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.541] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f5a0) returned 1 [0048.542] CryptGenRandom (in: hProv=0x59f5a0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.542] CryptReleaseContext (hProv=0x59f5a0, dwFlags=0x0) returned 1 [0048.542] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a0040 [0048.542] lstrlenA (lpString="010001") returned 6 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0790 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a01d8 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a08a8 [0048.542] GetProcessHeap () returned 0x560000 [0048.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.542] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a01d8 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d4a0 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c3d8 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d4a0 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3d8 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.543] GetProcessHeap () returned 0x560000 [0048.543] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.544] GetProcessHeap () returned 0x560000 [0048.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.545] GetProcessHeap () returned 0x560000 [0048.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.545] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.546] GetProcessHeap () returned 0x560000 [0048.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.547] GetProcessHeap () returned 0x560000 [0048.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.548] GetProcessHeap () returned 0x560000 [0048.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0040 | out: hHeap=0x560000) returned 1 [0048.548] WriteFile (in: hFile=0x230, lpBuffer=0x59ed98*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ed98*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0048.550] GetProcessHeap () returned 0x560000 [0048.550] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ed98, Size=0x30) returned 0x59ed98 [0048.550] GetProcessHeap () returned 0x560000 [0048.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.550] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.550] GetProcessHeap () returned 0x560000 [0048.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11c60) returned 0x5a2430 [0048.552] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x11c60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x11c60, lpOverlapped=0x0) returned 1 [0048.553] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.553] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x11c60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x11c60, lpOverlapped=0x0) returned 1 [0048.555] GetProcessHeap () returned 0x560000 [0048.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.555] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.555] WriteFile (in: hFile=0x230, lpBuffer=0x59ed98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ed98*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.556] CloseHandle (hObject=0x230) returned 1 [0048.559] GetProcessHeap () returned 0x560000 [0048.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0048.559] GetProcessHeap () returned 0x560000 [0048.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.559] GetProcessHeap () returned 0x560000 [0048.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0048.559] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif") returned="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif" [0048.559] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif.badday") returned="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif.badday" [0048.560] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zkrbwp75ze7sn_ni.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\zkrbwp75ze7sn_ni.gif.badday"), dwFlags=0x1) returned 1 [0048.560] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\zkrbWP75zE7SN_NI.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.560] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.560] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.560] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.560] GetProcessHeap () returned 0x560000 [0048.560] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0048.560] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4340780, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0xd33f3af0, ftLastAccessTime.dwHighDateTime=0x1d4c729, ftLastWriteTime.dwLowDateTime=0xd33f3af0, ftLastWriteTime.dwHighDateTime=0x1d4c729, nFileSizeHigh=0x0, nFileSizeLow=0x40d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlbx_luMJl82t7kC.jpg", cAlternateFileName="ZLBX_L~1.JPG")) returned 1 [0048.560] lstrcmpiW (lpString1="zlbx_luMJl82t7kC.jpg", lpString2=".") returned 1 [0048.560] lstrcmpiW (lpString1="zlbx_luMJl82t7kC.jpg", lpString2="..") returned 1 [0048.560] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="zlbx_luMJl82t7kC.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg" [0048.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zlbx_luMJl82t7kC.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.560] GetProcessHeap () returned 0x560000 [0048.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576b18 [0048.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zlbx_luMJl82t7kC.jpg", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zlbx_luMJl82t7kC.jpg", lpUsedDefaultChar=0x0) returned 21 [0048.561] lstrlenA (lpString="zlbx_luMJl82t7kC.jpg") returned 20 [0048.561] lstrlenA (lpString=".badday") returned 7 [0048.561] lstrlenA (lpString=".badday") returned 7 [0048.561] lstrlenA (lpString="zlbx_luMJl82t7kC.jpg") returned 20 [0048.561] lstrcmpiA (lpString1="7kC.jpg", lpString2=".badday") returned 1 [0048.561] lstrcmpiW (lpString1="zlbx_luMJl82t7kC.jpg", lpString2="how_to_back_files.html") returned 1 [0048.561] lstrcmpiW (lpString1="zlbx_luMJl82t7kC.jpg", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.561] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.561] lstrcmpiW (lpString1="zlbx_luMJl82t7kC.jpg", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.561] GetProcessHeap () returned 0x560000 [0048.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0048.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zlbx_lumjl82t7kc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.561] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=16594) returned 1 [0048.561] GetProcessHeap () returned 0x560000 [0048.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.561] GetProcessHeap () returned 0x560000 [0048.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f738 [0048.561] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg") returned 45 [0048.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.561] GetProcessHeap () returned 0x560000 [0048.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.561] GetProcessHeap () returned 0x560000 [0048.561] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x59edd0 [0048.562] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.562] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a01d8) returned 1 [0048.562] CryptGenRandom (in: hProv=0x5a01d8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.562] CryptReleaseContext (hProv=0x5a01d8, dwFlags=0x0) returned 1 [0048.562] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.562] GetProcessHeap () returned 0x560000 [0048.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a02e8 [0048.562] lstrlenA (lpString="010001") returned 6 [0048.562] GetProcessHeap () returned 0x560000 [0048.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0048.562] GetProcessHeap () returned 0x560000 [0048.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.562] GetProcessHeap () returned 0x560000 [0048.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0048.562] GetProcessHeap () returned 0x560000 [0048.562] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.562] GetProcessHeap () returned 0x560000 [0048.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0ad8 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fb78 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb78 | out: hHeap=0x560000) returned 1 [0048.563] GetProcessHeap () returned 0x560000 [0048.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.563] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x58d500 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ccd8 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58d500 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.564] GetProcessHeap () returned 0x560000 [0048.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.565] GetProcessHeap () returned 0x560000 [0048.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.566] GetProcessHeap () returned 0x560000 [0048.566] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.567] GetProcessHeap () returned 0x560000 [0048.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.567] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.568] GetProcessHeap () returned 0x560000 [0048.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.568] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.569] GetProcessHeap () returned 0x560000 [0048.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a02e8 | out: hHeap=0x560000) returned 1 [0048.569] WriteFile (in: hFile=0x230, lpBuffer=0x59edd0*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59edd0*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0048.571] GetProcessHeap () returned 0x560000 [0048.571] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59edd0, Size=0x30) returned 0x59edd0 [0048.571] GetProcessHeap () returned 0x560000 [0048.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.571] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.571] GetProcessHeap () returned 0x560000 [0048.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40e0) returned 0x5a2430 [0048.571] ReadFile (in: hFile=0x230, lpBuffer=0x5a2430, nNumberOfBytesToRead=0x40e0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesRead=0x24ad7e8*=0x40e0, lpOverlapped=0x0) returned 1 [0048.571] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.571] WriteFile (in: hFile=0x230, lpBuffer=0x5a2430*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a2430*, lpNumberOfBytesWritten=0x24ad7e4*=0x40e0, lpOverlapped=0x0) returned 1 [0048.573] GetProcessHeap () returned 0x560000 [0048.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2430 | out: hHeap=0x560000) returned 1 [0048.573] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.573] WriteFile (in: hFile=0x230, lpBuffer=0x59edd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59edd0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.574] CloseHandle (hObject=0x230) returned 1 [0048.575] GetProcessHeap () returned 0x560000 [0048.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0048.575] GetProcessHeap () returned 0x560000 [0048.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.575] GetProcessHeap () returned 0x560000 [0048.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f738 | out: hHeap=0x560000) returned 1 [0048.575] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg" [0048.575] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg.badday") returned="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg.badday" [0048.575] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zlbx_lumjl82t7kc.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\zlbx_lumjl82t7kc.jpg.badday"), dwFlags=0x1) returned 1 [0048.576] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\zlbx_luMJl82t7kC.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0048.576] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0048.576] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" [0048.576] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_to_back_files.html")) returned 0x20 [0048.576] GetProcessHeap () returned 0x560000 [0048.576] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b18 | out: hHeap=0x560000) returned 1 [0048.576] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4340780, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0xd33f3af0, ftLastAccessTime.dwHighDateTime=0x1d4c729, ftLastWriteTime.dwLowDateTime=0xd33f3af0, ftLastWriteTime.dwHighDateTime=0x1d4c729, nFileSizeHigh=0x0, nFileSizeLow=0x40d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlbx_luMJl82t7kC.jpg", cAlternateFileName="ZLBX_L~1.JPG")) returned 0 [0048.576] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0048.576] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0048.576] GetProcessHeap () returned 0x560000 [0048.576] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d80 | out: hHeap=0x560000) returned 1 [0048.576] GetProcessHeap () returned 0x560000 [0048.576] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.576] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned 40 [0048.576] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*" [0048.576] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0048.577] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.577] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.577] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.577] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.577] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.577] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.577] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.577] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" [0048.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.577] GetProcessHeap () returned 0x560000 [0048.577] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0048.577] lstrlenA (lpString="desktop.ini") returned 11 [0048.577] lstrlenA (lpString=".badday") returned 7 [0048.577] lstrlenA (lpString=".badday") returned 7 [0048.577] lstrlenA (lpString="desktop.ini") returned 11 [0048.577] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0048.577] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0048.577] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.577] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.577] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.577] GetProcessHeap () returned 0x560000 [0048.577] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0048.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.578] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=190) returned 1 [0048.578] GetProcessHeap () returned 0x560000 [0048.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.578] GetProcessHeap () returned 0x560000 [0048.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f5a0 [0048.578] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned 51 [0048.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.578] GetProcessHeap () returned 0x560000 [0048.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.578] GetProcessHeap () returned 0x560000 [0048.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x58d260 [0048.578] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.578] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59fc88) returned 1 [0048.579] CryptGenRandom (in: hProv=0x59fc88, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.579] CryptReleaseContext (hProv=0x59fc88, dwFlags=0x0) returned 1 [0048.579] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fea8 [0048.579] lstrlenA (lpString="010001") returned 6 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f738 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c108 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f738 | out: hHeap=0x560000) returned 1 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c858 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1280 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0048.579] GetProcessHeap () returned 0x560000 [0048.579] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.579] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ce0 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c588 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c588 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d10 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c6a8 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d10 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.580] GetProcessHeap () returned 0x560000 [0048.580] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.581] GetProcessHeap () returned 0x560000 [0048.581] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.581] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.582] GetProcessHeap () returned 0x560000 [0048.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.583] GetProcessHeap () returned 0x560000 [0048.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.584] GetProcessHeap () returned 0x560000 [0048.584] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ce0 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c108 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.585] GetProcessHeap () returned 0x560000 [0048.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fea8 | out: hHeap=0x560000) returned 1 [0048.585] WriteFile (in: hFile=0x230, lpBuffer=0x58d260*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d260*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0048.589] GetProcessHeap () returned 0x560000 [0048.589] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d260, Size=0x30) returned 0x58d260 [0048.589] GetProcessHeap () returned 0x560000 [0048.589] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.589] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.589] GetProcessHeap () returned 0x560000 [0048.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc0) returned 0x5a30d8 [0048.589] ReadFile (in: hFile=0x230, lpBuffer=0x5a30d8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a30d8*, lpNumberOfBytesRead=0x24ad7e8*=0xc0, lpOverlapped=0x0) returned 1 [0048.589] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.589] WriteFile (in: hFile=0x230, lpBuffer=0x5a30d8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a30d8*, lpNumberOfBytesWritten=0x24ad7e4*=0xc0, lpOverlapped=0x0) returned 1 [0048.590] GetProcessHeap () returned 0x560000 [0048.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a30d8 | out: hHeap=0x560000) returned 1 [0048.590] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.590] WriteFile (in: hFile=0x230, lpBuffer=0x58d260*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d260*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.591] CloseHandle (hObject=0x230) returned 1 [0048.592] GetProcessHeap () returned 0x560000 [0048.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0048.592] GetProcessHeap () returned 0x560000 [0048.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.592] GetProcessHeap () returned 0x560000 [0048.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5a0 | out: hHeap=0x560000) returned 1 [0048.593] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" [0048.593] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.badday" [0048.593] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0048.593] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned 1 [0048.593] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="" [0048.593] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\how_to_back_files.html" [0048.593] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\how_to_back_files.html")) returned 0xffffffff [0048.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0048.593] GetProcessHeap () returned 0x560000 [0048.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.593] GetProcessHeap () returned 0x560000 [0048.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f408 [0048.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.608] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.609] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.615] GetProcessHeap () returned 0x560000 [0048.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.615] GetProcessHeap () returned 0x560000 [0048.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0048.615] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0048.615] GetProcessHeap () returned 0x560000 [0048.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.615] GetProcessHeap () returned 0x560000 [0048.615] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fd98 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.622] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.625] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.675] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.683] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.688] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.691] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.698] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.704] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.707] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.708] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.709] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.710] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.711] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.712] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.713] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.714] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.714] GetProcessHeap () returned 0x560000 [0048.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.714] GetProcessHeap () returned 0x560000 [0048.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0048.714] CloseHandle (hObject=0x230) returned 1 [0048.714] GetProcessHeap () returned 0x560000 [0048.714] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.714] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.714] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0048.715] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0048.715] GetProcessHeap () returned 0x560000 [0048.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e5d0 | out: hHeap=0x560000) returned 1 [0048.715] GetProcessHeap () returned 0x560000 [0048.715] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.715] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned 37 [0048.715] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*" [0048.715] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579888 [0048.715] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.715] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.715] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.715] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.715] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.715] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.715] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.715] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" [0048.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.715] GetProcessHeap () returned 0x560000 [0048.715] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0048.715] lstrlenA (lpString="desktop.ini") returned 11 [0048.715] lstrlenA (lpString=".badday") returned 7 [0048.715] lstrlenA (lpString=".badday") returned 7 [0048.715] lstrlenA (lpString="desktop.ini") returned 11 [0048.715] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0048.716] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0048.716] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.716] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.716] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.716] GetProcessHeap () returned 0x560000 [0048.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.716] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=190) returned 1 [0048.716] GetProcessHeap () returned 0x560000 [0048.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.716] GetProcessHeap () returned 0x560000 [0048.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f738 [0048.716] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned 48 [0048.716] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.716] GetProcessHeap () returned 0x560000 [0048.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.716] GetProcessHeap () returned 0x560000 [0048.716] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x58d298 [0048.716] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.716] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59fa68) returned 1 [0048.717] CryptGenRandom (in: hProv=0x59fa68, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.717] CryptReleaseContext (hProv=0x59fa68, dwFlags=0x0) returned 1 [0048.717] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59ffb8 [0048.717] lstrlenA (lpString="010001") returned 6 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59fc88 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc88 | out: hHeap=0x560000) returned 1 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0e20 [0048.717] GetProcessHeap () returned 0x560000 [0048.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.717] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f408 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0f38 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d70 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c08 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58ccd8 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c08 | out: hHeap=0x560000) returned 1 [0048.718] GetProcessHeap () returned 0x560000 [0048.718] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.718] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ccd8 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.719] GetProcessHeap () returned 0x560000 [0048.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.719] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.720] GetProcessHeap () returned 0x560000 [0048.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.721] GetProcessHeap () returned 0x560000 [0048.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.722] GetProcessHeap () returned 0x560000 [0048.722] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d70 | out: hHeap=0x560000) returned 1 [0048.723] GetProcessHeap () returned 0x560000 [0048.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.724] GetProcessHeap () returned 0x560000 [0048.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.724] GetProcessHeap () returned 0x560000 [0048.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.724] GetProcessHeap () returned 0x560000 [0048.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0048.724] GetProcessHeap () returned 0x560000 [0048.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.724] GetProcessHeap () returned 0x560000 [0048.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffb8 | out: hHeap=0x560000) returned 1 [0048.724] WriteFile (in: hFile=0x230, lpBuffer=0x58d298*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d298*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0048.728] GetProcessHeap () returned 0x560000 [0048.728] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d298, Size=0x30) returned 0x58d298 [0048.728] GetProcessHeap () returned 0x560000 [0048.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.728] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.728] GetProcessHeap () returned 0x560000 [0048.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc0) returned 0x5a30d8 [0048.728] ReadFile (in: hFile=0x230, lpBuffer=0x5a30d8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a30d8*, lpNumberOfBytesRead=0x24ad7e8*=0xc0, lpOverlapped=0x0) returned 1 [0048.728] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.728] WriteFile (in: hFile=0x230, lpBuffer=0x5a30d8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a30d8*, lpNumberOfBytesWritten=0x24ad7e4*=0xc0, lpOverlapped=0x0) returned 1 [0048.729] GetProcessHeap () returned 0x560000 [0048.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a30d8 | out: hHeap=0x560000) returned 1 [0048.729] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.729] WriteFile (in: hFile=0x230, lpBuffer=0x58d298*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d298*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.730] CloseHandle (hObject=0x230) returned 1 [0048.731] GetProcessHeap () returned 0x560000 [0048.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.731] GetProcessHeap () returned 0x560000 [0048.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.731] GetProcessHeap () returned 0x560000 [0048.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f738 | out: hHeap=0x560000) returned 1 [0048.731] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" [0048.731] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.badday" [0048.732] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0048.732] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned 1 [0048.732] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="" [0048.732] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\how_to_back_files.html" [0048.732] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\how_to_back_files.html")) returned 0xffffffff [0048.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0048.733] GetProcessHeap () returned 0x560000 [0048.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.733] GetProcessHeap () returned 0x560000 [0048.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59faf0 [0048.740] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.745] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.755] GetProcessHeap () returned 0x560000 [0048.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.755] GetProcessHeap () returned 0x560000 [0048.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59faf0 | out: hHeap=0x560000) returned 1 [0048.755] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0048.755] GetProcessHeap () returned 0x560000 [0048.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.755] GetProcessHeap () returned 0x560000 [0048.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.763] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.764] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.765] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.766] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.771] GetProcessHeap () returned 0x560000 [0048.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.771] GetProcessHeap () returned 0x560000 [0048.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.771] CloseHandle (hObject=0x230) returned 1 [0048.772] GetProcessHeap () returned 0x560000 [0048.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.772] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.772] FindClose (in: hFindFile=0x579888 | out: hFindFile=0x579888) returned 1 [0048.772] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\OneDrive\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0048.772] GetProcessHeap () returned 0x560000 [0048.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579808 | out: hHeap=0x560000) returned 1 [0048.772] GetProcessHeap () returned 0x560000 [0048.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.772] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\") returned 25 [0048.772] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\*") returned="C:\\Users\\FD1HVy\\OneDrive\\*" [0048.772] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579808 [0048.772] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.772] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.772] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.772] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.772] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.772] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.772] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.772] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" [0048.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.773] GetProcessHeap () returned 0x560000 [0048.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0048.773] lstrlenA (lpString="desktop.ini") returned 11 [0048.773] lstrlenA (lpString=".badday") returned 7 [0048.773] lstrlenA (lpString=".badday") returned 7 [0048.773] lstrlenA (lpString="desktop.ini") returned 11 [0048.773] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0048.773] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0048.773] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.773] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.773] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.773] GetProcessHeap () returned 0x560000 [0048.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0048.773] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.773] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=97) returned 1 [0048.773] GetProcessHeap () returned 0x560000 [0048.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.773] GetProcessHeap () returned 0x560000 [0048.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.773] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned 36 [0048.773] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.773] GetProcessHeap () returned 0x560000 [0048.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.773] GetProcessHeap () returned 0x560000 [0048.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x58d2d0 [0048.774] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.774] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f8d0) returned 1 [0048.774] CryptGenRandom (in: hProv=0x59f8d0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.774] CryptReleaseContext (hProv=0x59f8d0, dwFlags=0x0) returned 1 [0048.774] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.774] GetProcessHeap () returned 0x560000 [0048.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f628 [0048.774] lstrlenA (lpString="010001") returned 6 [0048.774] GetProcessHeap () returned 0x560000 [0048.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0048.774] GetProcessHeap () returned 0x560000 [0048.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f5a0 [0048.774] GetProcessHeap () returned 0x560000 [0048.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c738 [0048.774] GetProcessHeap () returned 0x560000 [0048.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5a0 | out: hHeap=0x560000) returned 1 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c8e8 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0790 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f408 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0ad8 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e90 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c2b8 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c2b8 | out: hHeap=0x560000) returned 1 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ed8 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.775] GetProcessHeap () returned 0x560000 [0048.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.775] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c078 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ed8 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c078 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.776] GetProcessHeap () returned 0x560000 [0048.776] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.776] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.777] GetProcessHeap () returned 0x560000 [0048.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.778] GetProcessHeap () returned 0x560000 [0048.778] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.779] GetProcessHeap () returned 0x560000 [0048.779] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.779] GetProcessHeap () returned 0x560000 [0048.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e90 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c8e8 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c738 | out: hHeap=0x560000) returned 1 [0048.780] GetProcessHeap () returned 0x560000 [0048.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0048.781] GetProcessHeap () returned 0x560000 [0048.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.781] GetProcessHeap () returned 0x560000 [0048.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f628 | out: hHeap=0x560000) returned 1 [0048.781] WriteFile (in: hFile=0x230, lpBuffer=0x58d2d0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d2d0*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0048.786] GetProcessHeap () returned 0x560000 [0048.786] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58d2d0, Size=0x30) returned 0x58d2d0 [0048.786] GetProcessHeap () returned 0x560000 [0048.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.786] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.786] GetProcessHeap () returned 0x560000 [0048.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x70) returned 0x589f20 [0048.786] ReadFile (in: hFile=0x230, lpBuffer=0x589f20, nNumberOfBytesToRead=0x70, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x589f20*, lpNumberOfBytesRead=0x24ad7e8*=0x70, lpOverlapped=0x0) returned 1 [0048.786] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.786] WriteFile (in: hFile=0x230, lpBuffer=0x589f20*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x589f20*, lpNumberOfBytesWritten=0x24ad7e4*=0x70, lpOverlapped=0x0) returned 1 [0048.787] GetProcessHeap () returned 0x560000 [0048.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0048.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.787] WriteFile (in: hFile=0x230, lpBuffer=0x58d2d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58d2d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.788] CloseHandle (hObject=0x230) returned 1 [0048.789] GetProcessHeap () returned 0x560000 [0048.789] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0048.789] GetProcessHeap () returned 0x560000 [0048.789] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.789] GetProcessHeap () returned 0x560000 [0048.789] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.789] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" [0048.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.badday" [0048.789] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0048.790] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\OneDrive") returned 1 [0048.790] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\OneDrive" | out: pszPath="C:\\Users\\FD1HVy\\OneDrive\\") returned="" [0048.790] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\OneDrive\\how_to_back_files.html" [0048.790] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\onedrive\\how_to_back_files.html")) returned 0xffffffff [0048.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\onedrive\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0048.790] GetProcessHeap () returned 0x560000 [0048.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.790] GetProcessHeap () returned 0x560000 [0048.790] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f7c0 [0048.797] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.798] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.808] GetProcessHeap () returned 0x560000 [0048.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.808] GetProcessHeap () returned 0x560000 [0048.808] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f7c0 | out: hHeap=0x560000) returned 1 [0048.808] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0048.808] GetProcessHeap () returned 0x560000 [0048.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.809] GetProcessHeap () returned 0x560000 [0048.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.818] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.827] GetProcessHeap () returned 0x560000 [0048.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.827] GetProcessHeap () returned 0x560000 [0048.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.827] CloseHandle (hObject=0x230) returned 1 [0048.827] GetProcessHeap () returned 0x560000 [0048.827] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.827] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.827] FindClose (in: hFindFile=0x579808 | out: hFindFile=0x579808) returned 1 [0048.828] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\NetHood\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0048.828] GetProcessHeap () returned 0x560000 [0048.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5797c8 | out: hHeap=0x560000) returned 1 [0048.828] GetProcessHeap () returned 0x560000 [0048.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.828] lstrlenW (lpString="C:\\Users\\FD1HVy\\NetHood\\") returned 24 [0048.828] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\NetHood\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\*") returned="C:\\Users\\FD1HVy\\NetHood\\*" [0048.828] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0048.828] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\My Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0048.828] GetProcessHeap () returned 0x560000 [0048.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572da0 | out: hHeap=0x560000) returned 1 [0048.828] GetProcessHeap () returned 0x560000 [0048.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0048.828] lstrlenW (lpString="C:\\Users\\FD1HVy\\My Documents\\") returned 29 [0048.828] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\My Documents\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\*") returned="C:\\Users\\FD1HVy\\My Documents\\*" [0048.828] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0048.828] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0048.828] GetProcessHeap () returned 0x560000 [0048.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582f38 | out: hHeap=0x560000) returned 1 [0048.828] GetProcessHeap () returned 0x560000 [0048.828] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.828] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\") returned 22 [0048.828] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\*") returned="C:\\Users\\FD1HVy\\Music\\*" [0048.829] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53a6244c, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53a6244c, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0048.829] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.829] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x53a6244c, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x53a6244c, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.829] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.829] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.829] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24692850, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0x206a1790, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0x206a1790, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-_HxTeiwDnv", cAlternateFileName="-_HXTE~1")) returned 1 [0048.829] lstrcmpiW (lpString1="-_HxTeiwDnv", lpString2=".") returned 1 [0048.829] lstrcmpiW (lpString1="-_HxTeiwDnv", lpString2="..") returned 1 [0048.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="-_HxTeiwDnv" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv" [0048.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-_HxTeiwDnv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.829] GetProcessHeap () returned 0x560000 [0048.829] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-_HxTeiwDnv", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-_HxTeiwDnv", lpUsedDefaultChar=0x0) returned 12 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0048.829] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0048.830] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0048.831] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0048.831] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.831] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0048.831] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.831] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="-_HxTeiwDnv", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0048.831] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\" [0048.831] GetProcessHeap () returned 0x560000 [0048.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d8 [0048.831] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned 34 [0048.831] GetProcessHeap () returned 0x560000 [0048.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x46) returned 0x585910 [0048.831] lstrcpyW (in: lpString1=0x585910, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\" [0048.831] GetProcessHeap () returned 0x560000 [0048.831] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.831] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.831] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.831] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.831] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini" [0048.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.831] GetProcessHeap () returned 0x560000 [0048.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0048.831] lstrlenA (lpString="desktop.ini") returned 11 [0048.831] lstrlenA (lpString=".badday") returned 7 [0048.831] lstrlenA (lpString=".badday") returned 7 [0048.831] lstrlenA (lpString="desktop.ini") returned 11 [0048.831] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0048.831] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0048.831] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.831] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.831] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0048.832] GetProcessHeap () returned 0x560000 [0048.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0048.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.832] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=504) returned 1 [0048.832] GetProcessHeap () returned 0x560000 [0048.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.832] GetProcessHeap () returned 0x560000 [0048.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f518 [0048.832] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned 33 [0048.832] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.832] GetProcessHeap () returned 0x560000 [0048.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.832] GetProcessHeap () returned 0x560000 [0048.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x59ee08 [0048.832] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.832] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x59f9e0) returned 1 [0048.833] CryptGenRandom (in: hProv=0x59f9e0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.833] CryptReleaseContext (hProv=0x59f9e0, dwFlags=0x0) returned 1 [0048.833] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f8d0 [0048.833] lstrlenA (lpString="010001") returned 6 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f9e0 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c078 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f9e0 | out: hHeap=0x560000) returned 1 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cb28 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0e20 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.833] GetProcessHeap () returned 0x560000 [0048.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0048.833] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x59f958 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0bf0 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589c38 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cdf8 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f958 | out: hHeap=0x560000) returned 1 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cdf8 | out: hHeap=0x560000) returned 1 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b48 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58cbb8 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b48 | out: hHeap=0x560000) returned 1 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cbb8 | out: hHeap=0x560000) returned 1 [0048.834] GetProcessHeap () returned 0x560000 [0048.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.834] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.835] GetProcessHeap () returned 0x560000 [0048.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.835] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.836] GetProcessHeap () returned 0x560000 [0048.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.837] GetProcessHeap () returned 0x560000 [0048.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.837] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.838] GetProcessHeap () returned 0x560000 [0048.838] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.838] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589c38 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cb28 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c078 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.839] GetProcessHeap () returned 0x560000 [0048.839] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f8d0 | out: hHeap=0x560000) returned 1 [0048.839] WriteFile (in: hFile=0x230, lpBuffer=0x59ee08*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ee08*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0048.843] GetProcessHeap () returned 0x560000 [0048.843] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ee08, Size=0x30) returned 0x59ee08 [0048.843] GetProcessHeap () returned 0x560000 [0048.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.843] GetProcessHeap () returned 0x560000 [0048.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.843] ReadFile (in: hFile=0x230, lpBuffer=0x58a3b0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesRead=0x24ad7e8*=0x200, lpOverlapped=0x0) returned 1 [0048.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.843] WriteFile (in: hFile=0x230, lpBuffer=0x58a3b0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x200, lpOverlapped=0x0) returned 1 [0048.844] GetProcessHeap () returned 0x560000 [0048.844] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.844] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x59ee08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ee08*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.845] CloseHandle (hObject=0x230) returned 1 [0048.846] GetProcessHeap () returned 0x560000 [0048.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0048.846] GetProcessHeap () returned 0x560000 [0048.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.846] GetProcessHeap () returned 0x560000 [0048.846] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f518 | out: hHeap=0x560000) returned 1 [0048.847] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini" [0048.847] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini.badday" [0048.847] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0048.847] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0048.847] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0048.847] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" [0048.847] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\how_to_back_files.html")) returned 0xffffffff [0048.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0048.847] GetProcessHeap () returned 0x560000 [0048.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.847] GetProcessHeap () returned 0x560000 [0048.847] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2000 [0048.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.860] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.861] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.862] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.865] GetProcessHeap () returned 0x560000 [0048.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.865] GetProcessHeap () returned 0x560000 [0048.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2000 | out: hHeap=0x560000) returned 1 [0048.865] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0048.865] GetProcessHeap () returned 0x560000 [0048.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.865] GetProcessHeap () returned 0x560000 [0048.865] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2000 [0048.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.872] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.884] GetProcessHeap () returned 0x560000 [0048.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.884] GetProcessHeap () returned 0x560000 [0048.884] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2000 | out: hHeap=0x560000) returned 1 [0048.884] CloseHandle (hObject=0x230) returned 1 [0048.885] GetProcessHeap () returned 0x560000 [0048.885] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.885] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d88e4f0, ftCreationTime.dwHighDateTime=0x1d4d144, ftLastAccessTime.dwLowDateTime=0xe6ddc270, ftLastAccessTime.dwHighDateTime=0x1d4d0e8, ftLastWriteTime.dwLowDateTime=0xe6ddc270, ftLastWriteTime.dwHighDateTime=0x1d4d0e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MjKsH57dDdaGklY", cAlternateFileName="MJKSH5~1")) returned 1 [0048.885] lstrcmpiW (lpString1="MjKsH57dDdaGklY", lpString2=".") returned 1 [0048.885] lstrcmpiW (lpString1="MjKsH57dDdaGklY", lpString2="..") returned 1 [0048.885] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="MjKsH57dDdaGklY" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" [0048.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MjKsH57dDdaGklY", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.885] GetProcessHeap () returned 0x560000 [0048.885] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0048.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MjKsH57dDdaGklY", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MjKsH57dDdaGklY", lpUsedDefaultChar=0x0) returned 16 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.885] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.886] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MjKsH57dDdaGklY", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0048.887] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\" [0048.887] GetProcessHeap () returned 0x560000 [0048.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0048.887] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned 38 [0048.887] GetProcessHeap () returned 0x560000 [0048.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4e) returned 0x5a3828 [0048.887] lstrcpyW (in: lpString1=0x5a3828, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\" [0048.887] GetProcessHeap () returned 0x560000 [0048.887] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.887] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45493590, ftCreationTime.dwHighDateTime=0x1d4d48d, ftLastAccessTime.dwLowDateTime=0x50b1f3e0, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0x50b1f3e0, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x18064, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mTEBy2X ZKp66znunJe.m4a", cAlternateFileName="MTEBY2~1.M4A")) returned 1 [0048.887] lstrcmpiW (lpString1="mTEBy2X ZKp66znunJe.m4a", lpString2=".") returned 1 [0048.887] lstrcmpiW (lpString1="mTEBy2X ZKp66znunJe.m4a", lpString2="..") returned 1 [0048.887] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="mTEBy2X ZKp66znunJe.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a") returned="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a" [0048.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mTEBy2X ZKp66znunJe.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.887] GetProcessHeap () returned 0x560000 [0048.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576b98 [0048.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mTEBy2X ZKp66znunJe.m4a", cchWideChar=-1, lpMultiByteStr=0x576b98, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mTEBy2X ZKp66znunJe.m4a", lpUsedDefaultChar=0x0) returned 24 [0048.887] lstrlenA (lpString="mTEBy2X ZKp66znunJe.m4a") returned 23 [0048.887] lstrlenA (lpString=".badday") returned 7 [0048.887] lstrlenA (lpString=".badday") returned 7 [0048.887] lstrlenA (lpString="mTEBy2X ZKp66znunJe.m4a") returned 23 [0048.887] lstrcmpiA (lpString1="nJe.m4a", lpString2=".badday") returned 1 [0048.887] lstrcmpiW (lpString1="mTEBy2X ZKp66znunJe.m4a", lpString2="how_to_back_files.html") returned 1 [0048.887] lstrcmpiW (lpString1="mTEBy2X ZKp66znunJe.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.887] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.887] lstrcmpiW (lpString1="mTEBy2X ZKp66znunJe.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.887] GetProcessHeap () returned 0x560000 [0048.887] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0048.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a" (normalized: "c:\\users\\fd1hvy\\music\\mteby2x zkp66znunje.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.888] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=98404) returned 1 [0048.888] GetProcessHeap () returned 0x560000 [0048.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.888] GetProcessHeap () returned 0x560000 [0048.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0048.888] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a") returned 45 [0048.888] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.888] GetProcessHeap () returned 0x560000 [0048.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.888] GetProcessHeap () returned 0x560000 [0048.888] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38c) returned 0x59ee40 [0048.888] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.888] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1b38) returned 1 [0048.889] CryptGenRandom (in: hProv=0x5a1b38, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.889] CryptReleaseContext (hProv=0x5a1b38, dwFlags=0x0) returned 1 [0048.889] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0048.889] lstrlenA (lpString="010001") returned 6 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c078 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a08a8 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0ad8 [0048.889] GetProcessHeap () returned 0x560000 [0048.889] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.889] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4f8 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589cc8 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bec8 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589cc8 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bec8 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.890] GetProcessHeap () returned 0x560000 [0048.890] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.890] GetProcessHeap () returned 0x560000 [0048.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.891] GetProcessHeap () returned 0x560000 [0048.891] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.923] GetProcessHeap () returned 0x560000 [0048.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.923] GetProcessHeap () returned 0x560000 [0048.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.923] GetProcessHeap () returned 0x560000 [0048.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.923] GetProcessHeap () returned 0x560000 [0048.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.923] GetProcessHeap () returned 0x560000 [0048.923] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.923] GetProcessHeap () returned 0x560000 [0048.923] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.924] GetProcessHeap () returned 0x560000 [0048.924] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.924] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.925] GetProcessHeap () returned 0x560000 [0048.925] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.925] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.926] GetProcessHeap () returned 0x560000 [0048.926] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c078 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.927] GetProcessHeap () returned 0x560000 [0048.927] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0048.928] WriteFile (in: hFile=0x230, lpBuffer=0x59ee40*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ee40*, lpNumberOfBytesWritten=0x24ad864*=0x38c, lpOverlapped=0x0) returned 1 [0048.930] GetProcessHeap () returned 0x560000 [0048.930] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ee40, Size=0x30) returned 0x59ee40 [0048.930] GetProcessHeap () returned 0x560000 [0048.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.930] GetProcessHeap () returned 0x560000 [0048.931] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18070) returned 0x5a3c40 [0048.931] ReadFile (in: hFile=0x230, lpBuffer=0x5a3c40, nNumberOfBytesToRead=0x18070, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesRead=0x24ad7e8*=0x18070, lpOverlapped=0x0) returned 1 [0048.932] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x5a3c40*, nNumberOfBytesToWrite=0x18070, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesWritten=0x24ad7e4*=0x18070, lpOverlapped=0x0) returned 1 [0048.936] GetProcessHeap () returned 0x560000 [0048.936] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3c40 | out: hHeap=0x560000) returned 1 [0048.936] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x230, lpBuffer=0x59ee40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ee40*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.938] CloseHandle (hObject=0x230) returned 1 [0048.941] GetProcessHeap () returned 0x560000 [0048.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0048.941] GetProcessHeap () returned 0x560000 [0048.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.941] GetProcessHeap () returned 0x560000 [0048.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0048.941] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a") returned="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a" [0048.941] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a.badday" [0048.941] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a" (normalized: "c:\\users\\fd1hvy\\music\\mteby2x zkp66znunje.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\mteby2x zkp66znunje.m4a.badday"), dwFlags=0x1) returned 1 [0048.941] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\mTEBy2X ZKp66znunJe.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0048.942] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0048.942] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" [0048.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\how_to_back_files.html")) returned 0x20 [0048.942] GetProcessHeap () returned 0x560000 [0048.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b98 | out: hHeap=0x560000) returned 1 [0048.942] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa39e5420, ftCreationTime.dwHighDateTime=0x1d4cf76, ftLastAccessTime.dwLowDateTime=0x31cb90, ftLastAccessTime.dwHighDateTime=0x1d4ce3c, ftLastWriteTime.dwLowDateTime=0x31cb90, ftLastWriteTime.dwHighDateTime=0x1d4ce3c, nFileSizeHigh=0x0, nFileSizeLow=0x10f52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pP4K9Uq.wav", cAlternateFileName="")) returned 1 [0048.942] lstrcmpiW (lpString1="pP4K9Uq.wav", lpString2=".") returned 1 [0048.942] lstrcmpiW (lpString1="pP4K9Uq.wav", lpString2="..") returned 1 [0048.942] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="pP4K9Uq.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav") returned="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav" [0048.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pP4K9Uq.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.942] GetProcessHeap () returned 0x560000 [0048.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0048.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pP4K9Uq.wav", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pP4K9Uq.wav", lpUsedDefaultChar=0x0) returned 12 [0048.942] lstrlenA (lpString="pP4K9Uq.wav") returned 11 [0048.942] lstrlenA (lpString=".badday") returned 7 [0048.942] lstrlenA (lpString=".badday") returned 7 [0048.942] lstrlenA (lpString="pP4K9Uq.wav") returned 11 [0048.942] lstrcmpiA (lpString1="9Uq.wav", lpString2=".badday") returned 1 [0048.942] lstrcmpiW (lpString1="pP4K9Uq.wav", lpString2="how_to_back_files.html") returned 1 [0048.942] lstrcmpiW (lpString1="pP4K9Uq.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.942] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.942] lstrcmpiW (lpString1="pP4K9Uq.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.942] GetProcessHeap () returned 0x560000 [0048.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0048.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav" (normalized: "c:\\users\\fd1hvy\\music\\pp4k9uq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.942] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=69458) returned 1 [0048.943] GetProcessHeap () returned 0x560000 [0048.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.943] GetProcessHeap () returned 0x560000 [0048.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1cd0 [0048.943] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav") returned 33 [0048.943] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.943] GetProcessHeap () returned 0x560000 [0048.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.943] GetProcessHeap () returned 0x560000 [0048.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x59ee78 [0048.943] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.943] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2330) returned 1 [0048.943] CryptGenRandom (in: hProv=0x5a2330, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.943] CryptReleaseContext (hProv=0x5a2330, dwFlags=0x0) returned 1 [0048.943] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.943] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0048.944] lstrlenA (lpString="010001") returned 6 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c348 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cd68 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0448 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1050 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589ba8 [0048.944] GetProcessHeap () returned 0x560000 [0048.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58cc48 [0048.944] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cc48 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d70 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c3d8 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d70 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c3d8 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.945] GetProcessHeap () returned 0x560000 [0048.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.946] GetProcessHeap () returned 0x560000 [0048.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.947] GetProcessHeap () returned 0x560000 [0048.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.948] GetProcessHeap () returned 0x560000 [0048.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.949] GetProcessHeap () returned 0x560000 [0048.949] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589ba8 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58cd68 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c348 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.950] GetProcessHeap () returned 0x560000 [0048.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0048.950] WriteFile (in: hFile=0x230, lpBuffer=0x59ee78*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ee78*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0048.953] GetProcessHeap () returned 0x560000 [0048.953] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ee78, Size=0x30) returned 0x59ee78 [0048.953] GetProcessHeap () returned 0x560000 [0048.953] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.953] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.953] GetProcessHeap () returned 0x560000 [0048.953] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10f60) returned 0x5a3c40 [0048.953] ReadFile (in: hFile=0x230, lpBuffer=0x5a3c40, nNumberOfBytesToRead=0x10f60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesRead=0x24ad7e8*=0x10f60, lpOverlapped=0x0) returned 1 [0048.954] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.954] WriteFile (in: hFile=0x230, lpBuffer=0x5a3c40*, nNumberOfBytesToWrite=0x10f60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesWritten=0x24ad7e4*=0x10f60, lpOverlapped=0x0) returned 1 [0048.955] GetProcessHeap () returned 0x560000 [0048.956] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3c40 | out: hHeap=0x560000) returned 1 [0048.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.957] WriteFile (in: hFile=0x230, lpBuffer=0x59ee78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ee78*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.958] CloseHandle (hObject=0x230) returned 1 [0048.960] GetProcessHeap () returned 0x560000 [0048.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0048.960] GetProcessHeap () returned 0x560000 [0048.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.960] GetProcessHeap () returned 0x560000 [0048.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1cd0 | out: hHeap=0x560000) returned 1 [0048.960] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav") returned="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav" [0048.960] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav.badday" [0048.960] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav" (normalized: "c:\\users\\fd1hvy\\music\\pp4k9uq.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\pp4k9uq.wav.badday"), dwFlags=0x1) returned 1 [0048.961] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\pP4K9Uq.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0048.961] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0048.961] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" [0048.961] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\how_to_back_files.html")) returned 0x20 [0048.961] GetProcessHeap () returned 0x560000 [0048.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.961] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde648970, ftCreationTime.dwHighDateTime=0x1d4cb2b, ftLastAccessTime.dwLowDateTime=0x75140380, ftLastAccessTime.dwHighDateTime=0x1d4c8c7, ftLastWriteTime.dwLowDateTime=0x75140380, ftLastWriteTime.dwHighDateTime=0x1d4c8c7, nFileSizeHigh=0x0, nFileSizeLow=0x124ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YqycESTrORFjWh41LkQj.m4a", cAlternateFileName="YQYCES~1.M4A")) returned 1 [0048.961] lstrcmpiW (lpString1="YqycESTrORFjWh41LkQj.m4a", lpString2=".") returned 1 [0048.961] lstrcmpiW (lpString1="YqycESTrORFjWh41LkQj.m4a", lpString2="..") returned 1 [0048.961] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="YqycESTrORFjWh41LkQj.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a") returned="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a" [0048.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YqycESTrORFjWh41LkQj.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0048.961] GetProcessHeap () returned 0x560000 [0048.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d1c0 [0048.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YqycESTrORFjWh41LkQj.m4a", cchWideChar=-1, lpMultiByteStr=0x57d1c0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YqycESTrORFjWh41LkQj.m4a", lpUsedDefaultChar=0x0) returned 25 [0048.961] lstrlenA (lpString="YqycESTrORFjWh41LkQj.m4a") returned 24 [0048.961] lstrlenA (lpString=".badday") returned 7 [0048.961] lstrlenA (lpString=".badday") returned 7 [0048.961] lstrlenA (lpString="YqycESTrORFjWh41LkQj.m4a") returned 24 [0048.961] lstrcmpiA (lpString1="kQj.m4a", lpString2=".badday") returned 1 [0048.961] lstrcmpiW (lpString1="YqycESTrORFjWh41LkQj.m4a", lpString2="how_to_back_files.html") returned 1 [0048.961] lstrcmpiW (lpString1="YqycESTrORFjWh41LkQj.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.961] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.961] lstrcmpiW (lpString1="YqycESTrORFjWh41LkQj.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.962] GetProcessHeap () returned 0x560000 [0048.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0048.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a" (normalized: "c:\\users\\fd1hvy\\music\\yqycestrorfjwh41lkqj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.962] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=74923) returned 1 [0048.962] GetProcessHeap () returned 0x560000 [0048.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.962] GetProcessHeap () returned 0x560000 [0048.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0048.962] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a") returned 46 [0048.962] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.962] GetProcessHeap () returned 0x560000 [0048.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.962] GetProcessHeap () returned 0x560000 [0048.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59eeb0 [0048.962] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.962] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1bc0) returned 1 [0048.963] CryptGenRandom (in: hProv=0x5a1bc0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.963] CryptReleaseContext (hProv=0x5a1bc0, dwFlags=0x0) returned 1 [0048.963] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0048.963] lstrlenA (lpString="010001") returned 6 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58ca98 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0678 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0048.963] GetProcessHeap () returned 0x560000 [0048.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1b38 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0bf0 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c618 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1b38 | out: hHeap=0x560000) returned 1 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c618 | out: hHeap=0x560000) returned 1 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b78 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bf58 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b78 | out: hHeap=0x560000) returned 1 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.964] GetProcessHeap () returned 0x560000 [0048.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.965] GetProcessHeap () returned 0x560000 [0048.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.966] GetProcessHeap () returned 0x560000 [0048.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.967] GetProcessHeap () returned 0x560000 [0048.967] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.968] GetProcessHeap () returned 0x560000 [0048.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.969] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58ca98 | out: hHeap=0x560000) returned 1 [0048.969] GetProcessHeap () returned 0x560000 [0048.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.970] GetProcessHeap () returned 0x560000 [0048.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.970] GetProcessHeap () returned 0x560000 [0048.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0048.970] WriteFile (in: hFile=0x230, lpBuffer=0x59eeb0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eeb0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0048.971] GetProcessHeap () returned 0x560000 [0048.971] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59eeb0, Size=0x30) returned 0x59eeb0 [0048.971] GetProcessHeap () returned 0x560000 [0048.971] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.971] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.971] GetProcessHeap () returned 0x560000 [0048.971] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x124ab) returned 0x5a3c40 [0048.973] ReadFile (in: hFile=0x230, lpBuffer=0x5a3c40, nNumberOfBytesToRead=0x124ab, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesRead=0x24ad7e8*=0x124ab, lpOverlapped=0x0) returned 1 [0048.974] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.974] WriteFile (in: hFile=0x230, lpBuffer=0x5a3c40*, nNumberOfBytesToWrite=0x124ab, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesWritten=0x24ad7e4*=0x124ab, lpOverlapped=0x0) returned 1 [0048.976] GetProcessHeap () returned 0x560000 [0048.976] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3c40 | out: hHeap=0x560000) returned 1 [0048.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.976] WriteFile (in: hFile=0x230, lpBuffer=0x59eeb0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eeb0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.977] CloseHandle (hObject=0x230) returned 1 [0048.979] GetProcessHeap () returned 0x560000 [0048.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0048.979] GetProcessHeap () returned 0x560000 [0048.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.979] GetProcessHeap () returned 0x560000 [0048.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0048.979] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a") returned="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a" [0048.979] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a.badday" [0048.979] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a" (normalized: "c:\\users\\fd1hvy\\music\\yqycestrorfjwh41lkqj.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\yqycestrorfjwh41lkqj.m4a.badday"), dwFlags=0x1) returned 1 [0048.980] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\YqycESTrORFjWh41LkQj.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0048.980] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0048.980] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" [0048.980] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\how_to_back_files.html")) returned 0x20 [0048.980] GetProcessHeap () returned 0x560000 [0048.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0048.980] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee37f630, ftCreationTime.dwHighDateTime=0x1d4c918, ftLastAccessTime.dwLowDateTime=0xdd467560, ftLastAccessTime.dwHighDateTime=0x1d4d0b4, ftLastWriteTime.dwLowDateTime=0xdd467560, ftLastWriteTime.dwHighDateTime=0x1d4d0b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zkju.wav", cAlternateFileName="")) returned 1 [0048.980] lstrcmpiW (lpString1="zkju.wav", lpString2=".") returned 1 [0048.980] lstrcmpiW (lpString1="zkju.wav", lpString2="..") returned 1 [0048.980] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="zkju.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\zkju.wav") returned="C:\\Users\\FD1HVy\\Music\\zkju.wav" [0048.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zkju.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.980] GetProcessHeap () returned 0x560000 [0048.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0048.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zkju.wav", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zkju.wav", lpUsedDefaultChar=0x0) returned 9 [0048.980] lstrlenA (lpString="zkju.wav") returned 8 [0048.981] lstrlenA (lpString=".badday") returned 7 [0048.981] lstrlenA (lpString=".badday") returned 7 [0048.981] lstrlenA (lpString="zkju.wav") returned 8 [0048.981] lstrcmpiA (lpString1="kju.wav", lpString2=".badday") returned 1 [0048.981] lstrcmpiW (lpString1="zkju.wav", lpString2="how_to_back_files.html") returned 1 [0048.981] lstrcmpiW (lpString1="zkju.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0048.981] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0048.981] lstrcmpiW (lpString1="zkju.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0048.981] GetProcessHeap () returned 0x560000 [0048.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0048.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\zkju.wav" (normalized: "c:\\users\\fd1hvy\\music\\zkju.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.981] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=24398) returned 1 [0048.981] GetProcessHeap () returned 0x560000 [0048.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0048.981] GetProcessHeap () returned 0x560000 [0048.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0048.981] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\zkju.wav") returned 30 [0048.981] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.981] GetProcessHeap () returned 0x560000 [0048.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0048.981] GetProcessHeap () returned 0x560000 [0048.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x59eee8 [0048.981] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.981] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2088) returned 1 [0048.982] CryptGenRandom (in: hProv=0x5a2088, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0048.982] CryptReleaseContext (hProv=0x5a2088, dwFlags=0x0) returned 1 [0048.982] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0048.982] lstrlenA (lpString="010001") returned 6 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c978 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c078 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0678 [0048.982] GetProcessHeap () returned 0x560000 [0048.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e18 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589d28 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c6a8 [0048.983] GetProcessHeap () returned 0x560000 [0048.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589d28 | out: hHeap=0x560000) returned 1 [0048.983] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.984] GetProcessHeap () returned 0x560000 [0048.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.984] GetProcessHeap () returned 0x560000 [0048.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.985] GetProcessHeap () returned 0x560000 [0048.985] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.986] GetProcessHeap () returned 0x560000 [0048.986] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.986] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.987] GetProcessHeap () returned 0x560000 [0048.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.988] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0048.988] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e18 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c078 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c978 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0048.989] GetProcessHeap () returned 0x560000 [0048.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0048.989] WriteFile (in: hFile=0x230, lpBuffer=0x59eee8*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eee8*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0048.991] GetProcessHeap () returned 0x560000 [0048.991] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59eee8, Size=0x30) returned 0x59eee8 [0048.991] GetProcessHeap () returned 0x560000 [0048.992] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0048.992] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.992] GetProcessHeap () returned 0x560000 [0048.992] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5f50) returned 0x5a3c40 [0048.992] ReadFile (in: hFile=0x230, lpBuffer=0x5a3c40, nNumberOfBytesToRead=0x5f50, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesRead=0x24ad7e8*=0x5f50, lpOverlapped=0x0) returned 1 [0048.992] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.992] WriteFile (in: hFile=0x230, lpBuffer=0x5a3c40*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3c40*, lpNumberOfBytesWritten=0x24ad7e4*=0x5f50, lpOverlapped=0x0) returned 1 [0048.993] GetProcessHeap () returned 0x560000 [0048.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3c40 | out: hHeap=0x560000) returned 1 [0048.994] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0048.994] WriteFile (in: hFile=0x230, lpBuffer=0x59eee8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59eee8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0048.995] CloseHandle (hObject=0x230) returned 1 [0048.997] GetProcessHeap () returned 0x560000 [0048.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0048.997] GetProcessHeap () returned 0x560000 [0048.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0048.997] GetProcessHeap () returned 0x560000 [0048.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0048.997] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\zkju.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\zkju.wav") returned="C:\\Users\\FD1HVy\\Music\\zkju.wav" [0048.997] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\zkju.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\zkju.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\zkju.wav.badday" [0048.997] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\zkju.wav" (normalized: "c:\\users\\fd1hvy\\music\\zkju.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\zkju.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\zkju.wav.badday"), dwFlags=0x1) returned 1 [0048.997] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\zkju.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0048.998] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0048.998] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" [0048.998] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\how_to_back_files.html")) returned 0x20 [0048.998] GetProcessHeap () returned 0x560000 [0048.998] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0048.998] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee37f630, ftCreationTime.dwHighDateTime=0x1d4c918, ftLastAccessTime.dwLowDateTime=0xdd467560, ftLastAccessTime.dwHighDateTime=0x1d4d0b4, ftLastWriteTime.dwLowDateTime=0xdd467560, ftLastWriteTime.dwHighDateTime=0x1d4d0b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zkju.wav", cAlternateFileName="")) returned 0 [0048.998] FindClose (in: hFindFile=0x5797c8 | out: hFindFile=0x5797c8) returned 1 [0048.998] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\" [0048.998] GetProcessHeap () returned 0x560000 [0048.998] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3828 | out: hHeap=0x560000) returned 1 [0048.999] GetProcessHeap () returned 0x560000 [0048.999] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0048.999] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned 38 [0048.999] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\*") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\*" [0048.999] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d88e4f0, ftCreationTime.dwHighDateTime=0x1d4d144, ftLastAccessTime.dwLowDateTime=0xe6ddc270, ftLastAccessTime.dwHighDateTime=0x1d4d0e8, ftLastWriteTime.dwLowDateTime=0xe6ddc270, ftLastWriteTime.dwHighDateTime=0x1d4d0e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0048.999] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.999] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d88e4f0, ftCreationTime.dwHighDateTime=0x1d4d144, ftLastAccessTime.dwLowDateTime=0xe6ddc270, ftLastAccessTime.dwHighDateTime=0x1d4d0e8, ftLastWriteTime.dwLowDateTime=0xe6ddc270, ftLastWriteTime.dwHighDateTime=0x1d4d0e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.999] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.999] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.999] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb034b4f0, ftCreationTime.dwHighDateTime=0x1d4c629, ftLastAccessTime.dwLowDateTime=0x99852540, ftLastAccessTime.dwHighDateTime=0x1d4d255, ftLastWriteTime.dwLowDateTime=0x99852540, ftLastWriteTime.dwHighDateTime=0x1d4d255, nFileSizeHigh=0x0, nFileSizeLow=0x33ad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e_5HlcoeqsGxV1P9MI.wav", cAlternateFileName="E_5HLC~1.WAV")) returned 1 [0048.999] lstrcmpiW (lpString1="e_5HlcoeqsGxV1P9MI.wav", lpString2=".") returned 1 [0048.999] lstrcmpiW (lpString1="e_5HlcoeqsGxV1P9MI.wav", lpString2="..") returned 1 [0048.999] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="e_5HlcoeqsGxV1P9MI.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav" [0048.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e_5HlcoeqsGxV1P9MI.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.999] GetProcessHeap () returned 0x560000 [0048.999] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576838 [0048.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e_5HlcoeqsGxV1P9MI.wav", cchWideChar=-1, lpMultiByteStr=0x576838, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e_5HlcoeqsGxV1P9MI.wav", lpUsedDefaultChar=0x0) returned 23 [0048.999] lstrlenA (lpString="e_5HlcoeqsGxV1P9MI.wav") returned 22 [0049.000] lstrlenA (lpString=".badday") returned 7 [0049.000] lstrlenA (lpString=".badday") returned 7 [0049.000] lstrlenA (lpString="e_5HlcoeqsGxV1P9MI.wav") returned 22 [0049.000] lstrcmpiA (lpString1="9MI.wav", lpString2=".badday") returned 1 [0049.000] lstrcmpiW (lpString1="e_5HlcoeqsGxV1P9MI.wav", lpString2="how_to_back_files.html") returned -1 [0049.000] lstrcmpiW (lpString1="e_5HlcoeqsGxV1P9MI.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.000] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.000] lstrcmpiW (lpString1="e_5HlcoeqsGxV1P9MI.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0049.000] GetProcessHeap () returned 0x560000 [0049.000] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0049.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\e_5hlcoeqsgxv1p9mi.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.000] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=13229) returned 1 [0049.000] GetProcessHeap () returned 0x560000 [0049.000] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.000] GetProcessHeap () returned 0x560000 [0049.000] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0049.000] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav") returned 60 [0049.000] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.000] GetProcessHeap () returned 0x560000 [0049.000] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.000] GetProcessHeap () returned 0x560000 [0049.000] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59ef20 [0049.001] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.001] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1808) returned 1 [0049.001] CryptGenRandom (in: hProv=0x5a1808, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.001] CryptReleaseContext (hProv=0x5a1808, dwFlags=0x0) returned 1 [0049.001] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.001] GetProcessHeap () returned 0x560000 [0049.001] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0049.001] lstrlenA (lpString="010001") returned 6 [0049.001] GetProcessHeap () returned 0x560000 [0049.001] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0049.001] GetProcessHeap () returned 0x560000 [0049.001] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0049.001] GetProcessHeap () returned 0x560000 [0049.001] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c588 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c4f8 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0560 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58bf58 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.002] GetProcessHeap () returned 0x560000 [0049.002] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3828 [0049.002] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58bf58 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3828 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58bf58 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.003] GetProcessHeap () returned 0x560000 [0049.003] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.003] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.004] GetProcessHeap () returned 0x560000 [0049.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.005] GetProcessHeap () returned 0x560000 [0049.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.006] GetProcessHeap () returned 0x560000 [0049.006] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c4f8 | out: hHeap=0x560000) returned 1 [0049.007] GetProcessHeap () returned 0x560000 [0049.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.008] GetProcessHeap () returned 0x560000 [0049.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c588 | out: hHeap=0x560000) returned 1 [0049.008] GetProcessHeap () returned 0x560000 [0049.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0049.008] GetProcessHeap () returned 0x560000 [0049.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.008] GetProcessHeap () returned 0x560000 [0049.008] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0049.008] WriteFile (in: hFile=0x230, lpBuffer=0x59ef20*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ef20*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.009] GetProcessHeap () returned 0x560000 [0049.009] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ef20, Size=0x30) returned 0x59ef20 [0049.009] GetProcessHeap () returned 0x560000 [0049.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.009] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.009] GetProcessHeap () returned 0x560000 [0049.009] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x33ad) returned 0x5a3840 [0049.010] ReadFile (in: hFile=0x230, lpBuffer=0x5a3840, nNumberOfBytesToRead=0x33ad, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesRead=0x24ad7e8*=0x33ad, lpOverlapped=0x0) returned 1 [0049.010] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.010] WriteFile (in: hFile=0x230, lpBuffer=0x5a3840*, nNumberOfBytesToWrite=0x33ad, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesWritten=0x24ad7e4*=0x33ad, lpOverlapped=0x0) returned 1 [0049.011] GetProcessHeap () returned 0x560000 [0049.011] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3840 | out: hHeap=0x560000) returned 1 [0049.011] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.011] WriteFile (in: hFile=0x230, lpBuffer=0x59ef20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ef20*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.012] CloseHandle (hObject=0x230) returned 1 [0049.013] GetProcessHeap () returned 0x560000 [0049.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0049.013] GetProcessHeap () returned 0x560000 [0049.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.013] GetProcessHeap () returned 0x560000 [0049.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0049.014] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav" [0049.014] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav.badday" [0049.014] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\e_5hlcoeqsgxv1p9mi.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\e_5hlcoeqsgxv1p9mi.wav.badday"), dwFlags=0x1) returned 1 [0049.014] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\e_5HlcoeqsGxV1P9MI.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned 1 [0049.014] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="" [0049.014] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" [0049.014] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html")) returned 0xffffffff [0049.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0049.015] GetProcessHeap () returned 0x560000 [0049.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.015] GetProcessHeap () returned 0x560000 [0049.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0049.022] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.033] GetProcessHeap () returned 0x560000 [0049.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.033] GetProcessHeap () returned 0x560000 [0049.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0049.033] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0049.034] GetProcessHeap () returned 0x560000 [0049.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.034] GetProcessHeap () returned 0x560000 [0049.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0049.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.042] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.045] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.063] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.064] GetProcessHeap () returned 0x560000 [0049.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.064] GetProcessHeap () returned 0x560000 [0049.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0049.064] CloseHandle (hObject=0x230) returned 1 [0049.065] GetProcessHeap () returned 0x560000 [0049.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576838 | out: hHeap=0x560000) returned 1 [0049.065] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d78740, ftCreationTime.dwHighDateTime=0x1d4d099, ftLastAccessTime.dwLowDateTime=0x60d2e040, ftLastAccessTime.dwHighDateTime=0x1d4c9c5, ftLastWriteTime.dwLowDateTime=0x60d2e040, ftLastWriteTime.dwHighDateTime=0x1d4c9c5, nFileSizeHigh=0x0, nFileSizeLow=0xe61b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hbvx2H x.m4a", cAlternateFileName="HBVX2H~1.M4A")) returned 1 [0049.065] lstrcmpiW (lpString1="Hbvx2H x.m4a", lpString2=".") returned 1 [0049.065] lstrcmpiW (lpString1="Hbvx2H x.m4a", lpString2="..") returned 1 [0049.065] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="Hbvx2H x.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a" [0049.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hbvx2H x.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.065] GetProcessHeap () returned 0x560000 [0049.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0049.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hbvx2H x.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hbvx2H x.m4a", lpUsedDefaultChar=0x0) returned 13 [0049.065] lstrlenA (lpString="Hbvx2H x.m4a") returned 12 [0049.065] lstrlenA (lpString=".badday") returned 7 [0049.065] lstrlenA (lpString=".badday") returned 7 [0049.065] lstrlenA (lpString="Hbvx2H x.m4a") returned 12 [0049.065] lstrcmpiA (lpString1="H x.m4a", lpString2=".badday") returned 1 [0049.065] lstrcmpiW (lpString1="Hbvx2H x.m4a", lpString2="how_to_back_files.html") returned -1 [0049.065] lstrcmpiW (lpString1="Hbvx2H x.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.065] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.065] lstrcmpiW (lpString1="Hbvx2H x.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0049.065] GetProcessHeap () returned 0x560000 [0049.065] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0049.065] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\hbvx2h x.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.066] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=58907) returned 1 [0049.066] GetProcessHeap () returned 0x560000 [0049.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.066] GetProcessHeap () returned 0x560000 [0049.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0049.066] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a") returned 50 [0049.066] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.066] GetProcessHeap () returned 0x560000 [0049.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.066] GetProcessHeap () returned 0x560000 [0049.066] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59ef58 [0049.066] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.066] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a15e8) returned 1 [0049.067] CryptGenRandom (in: hProv=0x5a15e8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.067] CryptReleaseContext (hProv=0x5a15e8, dwFlags=0x0) returned 1 [0049.067] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0049.067] lstrlenA (lpString="010001") returned 6 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c468 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c198 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1168 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0560 [0049.067] GetProcessHeap () returned 0x560000 [0049.067] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3810 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x58c6a8 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c6a8 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3798 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x58c858 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3798 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c858 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.068] GetProcessHeap () returned 0x560000 [0049.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.069] GetProcessHeap () returned 0x560000 [0049.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.069] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.070] GetProcessHeap () returned 0x560000 [0049.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.071] GetProcessHeap () returned 0x560000 [0049.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.071] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.072] GetProcessHeap () returned 0x560000 [0049.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3810 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c198 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58c468 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0049.073] GetProcessHeap () returned 0x560000 [0049.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.085] GetProcessHeap () returned 0x560000 [0049.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0049.085] WriteFile (in: hFile=0x230, lpBuffer=0x59ef58*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ef58*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.087] GetProcessHeap () returned 0x560000 [0049.087] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ef58, Size=0x30) returned 0x59ef58 [0049.088] GetProcessHeap () returned 0x560000 [0049.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.088] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.088] GetProcessHeap () returned 0x560000 [0049.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe61b) returned 0x5a3840 [0049.088] ReadFile (in: hFile=0x230, lpBuffer=0x5a3840, nNumberOfBytesToRead=0xe61b, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesRead=0x24ad7e8*=0xe61b, lpOverlapped=0x0) returned 1 [0049.089] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.089] WriteFile (in: hFile=0x230, lpBuffer=0x5a3840*, nNumberOfBytesToWrite=0xe61b, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesWritten=0x24ad7e4*=0xe61b, lpOverlapped=0x0) returned 1 [0049.091] GetProcessHeap () returned 0x560000 [0049.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3840 | out: hHeap=0x560000) returned 1 [0049.092] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.092] WriteFile (in: hFile=0x230, lpBuffer=0x59ef58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ef58*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.093] CloseHandle (hObject=0x230) returned 1 [0049.095] GetProcessHeap () returned 0x560000 [0049.095] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0049.095] GetProcessHeap () returned 0x560000 [0049.095] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.095] GetProcessHeap () returned 0x560000 [0049.095] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0049.095] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a" [0049.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a.badday" [0049.095] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\hbvx2h x.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\hbvx2h x.m4a.badday"), dwFlags=0x1) returned 1 [0049.096] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\Hbvx2H x.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned 1 [0049.096] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="" [0049.096] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" [0049.096] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html")) returned 0x20 [0049.097] GetProcessHeap () returned 0x560000 [0049.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.097] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb99cfba0, ftCreationTime.dwHighDateTime=0x1d4c832, ftLastAccessTime.dwLowDateTime=0x28fa11a0, ftLastAccessTime.dwHighDateTime=0x1d4d0a7, ftLastWriteTime.dwLowDateTime=0x28fa11a0, ftLastWriteTime.dwHighDateTime=0x1d4d0a7, nFileSizeHigh=0x0, nFileSizeLow=0xf5af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hMB7brPKqyg.mp3", cAlternateFileName="HMB7BR~1.MP3")) returned 1 [0049.097] lstrcmpiW (lpString1="hMB7brPKqyg.mp3", lpString2=".") returned 1 [0049.097] lstrcmpiW (lpString1="hMB7brPKqyg.mp3", lpString2="..") returned 1 [0049.097] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="hMB7brPKqyg.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3" [0049.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hMB7brPKqyg.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.097] GetProcessHeap () returned 0x560000 [0049.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0049.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hMB7brPKqyg.mp3", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hMB7brPKqyg.mp3", lpUsedDefaultChar=0x0) returned 16 [0049.097] lstrlenA (lpString="hMB7brPKqyg.mp3") returned 15 [0049.097] lstrlenA (lpString=".badday") returned 7 [0049.097] lstrlenA (lpString=".badday") returned 7 [0049.097] lstrlenA (lpString="hMB7brPKqyg.mp3") returned 15 [0049.097] lstrcmpiA (lpString1="qyg.mp3", lpString2=".badday") returned 1 [0049.097] lstrcmpiW (lpString1="hMB7brPKqyg.mp3", lpString2="how_to_back_files.html") returned -1 [0049.097] lstrcmpiW (lpString1="hMB7brPKqyg.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.097] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.097] lstrcmpiW (lpString1="hMB7brPKqyg.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0049.097] GetProcessHeap () returned 0x560000 [0049.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0049.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\hmb7brpkqyg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.097] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=62895) returned 1 [0049.098] GetProcessHeap () returned 0x560000 [0049.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.098] GetProcessHeap () returned 0x560000 [0049.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0049.098] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3") returned 53 [0049.098] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.098] GetProcessHeap () returned 0x560000 [0049.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.098] GetProcessHeap () returned 0x560000 [0049.098] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x59ef90 [0049.098] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.098] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1670) returned 1 [0049.099] CryptGenRandom (in: hProv=0x5a1670, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.099] CryptReleaseContext (hProv=0x5a1670, dwFlags=0x0) returned 1 [0049.099] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0049.099] lstrlenA (lpString="010001") returned 6 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0049.099] GetProcessHeap () returned 0x560000 [0049.099] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0bf0 [0049.099] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1168 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3678 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a36f0 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.100] GetProcessHeap () returned 0x560000 [0049.100] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5870b0 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a36f0 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.101] GetProcessHeap () returned 0x560000 [0049.101] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.101] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.102] GetProcessHeap () returned 0x560000 [0049.102] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.103] GetProcessHeap () returned 0x560000 [0049.103] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.103] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.104] GetProcessHeap () returned 0x560000 [0049.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.104] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3678 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.105] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0049.105] GetProcessHeap () returned 0x560000 [0049.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0049.106] GetProcessHeap () returned 0x560000 [0049.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0049.106] GetProcessHeap () returned 0x560000 [0049.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.106] GetProcessHeap () returned 0x560000 [0049.106] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0049.106] WriteFile (in: hFile=0x230, lpBuffer=0x59ef90*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ef90*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.110] GetProcessHeap () returned 0x560000 [0049.110] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59ef90, Size=0x30) returned 0x59ef90 [0049.110] GetProcessHeap () returned 0x560000 [0049.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.110] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.110] GetProcessHeap () returned 0x560000 [0049.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf5af) returned 0x5a3840 [0049.112] ReadFile (in: hFile=0x230, lpBuffer=0x5a3840, nNumberOfBytesToRead=0xf5af, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesRead=0x24ad7e8*=0xf5af, lpOverlapped=0x0) returned 1 [0049.113] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.113] WriteFile (in: hFile=0x230, lpBuffer=0x5a3840*, nNumberOfBytesToWrite=0xf5af, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesWritten=0x24ad7e4*=0xf5af, lpOverlapped=0x0) returned 1 [0049.115] GetProcessHeap () returned 0x560000 [0049.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3840 | out: hHeap=0x560000) returned 1 [0049.115] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.115] WriteFile (in: hFile=0x230, lpBuffer=0x59ef90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x59ef90*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.116] CloseHandle (hObject=0x230) returned 1 [0049.118] GetProcessHeap () returned 0x560000 [0049.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0049.118] GetProcessHeap () returned 0x560000 [0049.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.118] GetProcessHeap () returned 0x560000 [0049.118] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0049.118] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3" [0049.118] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3.badday" [0049.118] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\hmb7brpkqyg.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\hmb7brpkqyg.mp3.badday"), dwFlags=0x1) returned 1 [0049.119] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\hMB7brPKqyg.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned 1 [0049.119] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="" [0049.119] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" [0049.119] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html")) returned 0x20 [0049.119] GetProcessHeap () returned 0x560000 [0049.119] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.119] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe253d700, ftCreationTime.dwHighDateTime=0x1d4ccd6, ftLastAccessTime.dwLowDateTime=0x27977920, ftLastAccessTime.dwHighDateTime=0x1d4d5f1, ftLastWriteTime.dwLowDateTime=0x27977920, ftLastWriteTime.dwHighDateTime=0x1d4d5f1, nFileSizeHigh=0x0, nFileSizeLow=0x7bf6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XkaP5Zds4IiXNgn9.m4a", cAlternateFileName="XKAP5Z~1.M4A")) returned 1 [0049.119] lstrcmpiW (lpString1="XkaP5Zds4IiXNgn9.m4a", lpString2=".") returned 1 [0049.119] lstrcmpiW (lpString1="XkaP5Zds4IiXNgn9.m4a", lpString2="..") returned 1 [0049.119] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="XkaP5Zds4IiXNgn9.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a" [0049.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XkaP5Zds4IiXNgn9.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0049.119] GetProcessHeap () returned 0x560000 [0049.119] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576838 [0049.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XkaP5Zds4IiXNgn9.m4a", cchWideChar=-1, lpMultiByteStr=0x576838, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XkaP5Zds4IiXNgn9.m4a", lpUsedDefaultChar=0x0) returned 21 [0049.119] lstrlenA (lpString="XkaP5Zds4IiXNgn9.m4a") returned 20 [0049.119] lstrlenA (lpString=".badday") returned 7 [0049.120] lstrlenA (lpString=".badday") returned 7 [0049.120] lstrlenA (lpString="XkaP5Zds4IiXNgn9.m4a") returned 20 [0049.120] lstrcmpiA (lpString1="gn9.m4a", lpString2=".badday") returned 1 [0049.120] lstrcmpiW (lpString1="XkaP5Zds4IiXNgn9.m4a", lpString2="how_to_back_files.html") returned 1 [0049.120] lstrcmpiW (lpString1="XkaP5Zds4IiXNgn9.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.120] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.120] lstrcmpiW (lpString1="XkaP5Zds4IiXNgn9.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0049.120] GetProcessHeap () returned 0x560000 [0049.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0049.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\xkap5zds4iixngn9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.120] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=31734) returned 1 [0049.120] GetProcessHeap () returned 0x560000 [0049.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.120] GetProcessHeap () returned 0x560000 [0049.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0049.120] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a") returned 58 [0049.120] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.120] GetProcessHeap () returned 0x560000 [0049.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.120] GetProcessHeap () returned 0x560000 [0049.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a3840 [0049.120] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.120] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1780) returned 1 [0049.121] CryptGenRandom (in: hProv=0x5a1780, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.121] CryptReleaseContext (hProv=0x5a1780, dwFlags=0x0) returned 1 [0049.121] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.121] GetProcessHeap () returned 0x560000 [0049.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0049.121] lstrlenA (lpString="010001") returned 6 [0049.121] GetProcessHeap () returned 0x560000 [0049.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0049.121] GetProcessHeap () returned 0x560000 [0049.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0049.121] GetProcessHeap () returned 0x560000 [0049.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0049.121] GetProcessHeap () returned 0x560000 [0049.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0049.121] GetProcessHeap () returned 0x560000 [0049.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0560 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3678 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.122] GetProcessHeap () returned 0x560000 [0049.122] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587410 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3678 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.123] GetProcessHeap () returned 0x560000 [0049.123] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.123] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.124] GetProcessHeap () returned 0x560000 [0049.124] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.125] GetProcessHeap () returned 0x560000 [0049.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.126] GetProcessHeap () returned 0x560000 [0049.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0049.127] GetProcessHeap () returned 0x560000 [0049.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.128] GetProcessHeap () returned 0x560000 [0049.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0049.128] WriteFile (in: hFile=0x230, lpBuffer=0x5a3840*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.130] GetProcessHeap () returned 0x560000 [0049.130] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3840, Size=0x30) returned 0x5a3840 [0049.130] GetProcessHeap () returned 0x560000 [0049.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.130] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.130] GetProcessHeap () returned 0x560000 [0049.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7bf6) returned 0x5a3878 [0049.130] ReadFile (in: hFile=0x230, lpBuffer=0x5a3878, nNumberOfBytesToRead=0x7bf6, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3878*, lpNumberOfBytesRead=0x24ad7e8*=0x7bf6, lpOverlapped=0x0) returned 1 [0049.130] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.130] WriteFile (in: hFile=0x230, lpBuffer=0x5a3878*, nNumberOfBytesToWrite=0x7bf6, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3878*, lpNumberOfBytesWritten=0x24ad7e4*=0x7bf6, lpOverlapped=0x0) returned 1 [0049.132] GetProcessHeap () returned 0x560000 [0049.132] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3878 | out: hHeap=0x560000) returned 1 [0049.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.133] WriteFile (in: hFile=0x230, lpBuffer=0x5a3840*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3840*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.134] CloseHandle (hObject=0x230) returned 1 [0049.136] GetProcessHeap () returned 0x560000 [0049.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0049.136] GetProcessHeap () returned 0x560000 [0049.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.136] GetProcessHeap () returned 0x560000 [0049.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0049.136] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a" [0049.136] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a.badday" [0049.136] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\xkap5zds4iixngn9.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\xkap5zds4iixngn9.m4a.badday"), dwFlags=0x1) returned 1 [0049.137] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\XkaP5Zds4IiXNgn9.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned 1 [0049.137] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="" [0049.137] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" [0049.137] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html")) returned 0x20 [0049.137] GetProcessHeap () returned 0x560000 [0049.138] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576838 | out: hHeap=0x560000) returned 1 [0049.138] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8064b0, ftCreationTime.dwHighDateTime=0x1d4cfb7, ftLastAccessTime.dwLowDateTime=0xb37092e0, ftLastAccessTime.dwHighDateTime=0x1d4c946, ftLastWriteTime.dwLowDateTime=0xb37092e0, ftLastWriteTime.dwHighDateTime=0x1d4c946, nFileSizeHigh=0x0, nFileSizeLow=0xddaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YZbwDty45.mp3", cAlternateFileName="YZBWDT~1.MP3")) returned 1 [0049.138] lstrcmpiW (lpString1="YZbwDty45.mp3", lpString2=".") returned 1 [0049.138] lstrcmpiW (lpString1="YZbwDty45.mp3", lpString2="..") returned 1 [0049.138] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="YZbwDty45.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3" [0049.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YZbwDty45.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.138] GetProcessHeap () returned 0x560000 [0049.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0049.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YZbwDty45.mp3", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YZbwDty45.mp3", lpUsedDefaultChar=0x0) returned 14 [0049.138] lstrlenA (lpString="YZbwDty45.mp3") returned 13 [0049.138] lstrlenA (lpString=".badday") returned 7 [0049.138] lstrlenA (lpString=".badday") returned 7 [0049.138] lstrlenA (lpString="YZbwDty45.mp3") returned 13 [0049.138] lstrcmpiA (lpString1="y45.mp3", lpString2=".badday") returned 1 [0049.138] lstrcmpiW (lpString1="YZbwDty45.mp3", lpString2="how_to_back_files.html") returned 1 [0049.138] lstrcmpiW (lpString1="YZbwDty45.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.138] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.138] lstrcmpiW (lpString1="YZbwDty45.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0049.138] GetProcessHeap () returned 0x560000 [0049.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0049.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\yzbwdty45.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.138] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=56751) returned 1 [0049.138] GetProcessHeap () returned 0x560000 [0049.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.138] GetProcessHeap () returned 0x560000 [0049.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0049.138] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3") returned 51 [0049.138] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.139] GetProcessHeap () returned 0x560000 [0049.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.139] GetProcessHeap () returned 0x560000 [0049.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x5a4880 [0049.139] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.139] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1560) returned 1 [0049.139] CryptGenRandom (in: hProv=0x5a1560, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.139] CryptReleaseContext (hProv=0x5a1560, dwFlags=0x0) returned 1 [0049.139] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.139] GetProcessHeap () returned 0x560000 [0049.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0049.139] lstrlenA (lpString="010001") returned 6 [0049.139] GetProcessHeap () returned 0x560000 [0049.139] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0bf0 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3708 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0049.140] GetProcessHeap () returned 0x560000 [0049.140] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0049.140] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3690 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586ba0 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3690 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.141] GetProcessHeap () returned 0x560000 [0049.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.142] GetProcessHeap () returned 0x560000 [0049.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.143] GetProcessHeap () returned 0x560000 [0049.143] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.143] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.144] GetProcessHeap () returned 0x560000 [0049.144] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.144] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.145] GetProcessHeap () returned 0x560000 [0049.145] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3708 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.146] GetProcessHeap () returned 0x560000 [0049.146] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0049.146] WriteFile (in: hFile=0x230, lpBuffer=0x5a4880*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4880*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0049.148] GetProcessHeap () returned 0x560000 [0049.148] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4880, Size=0x30) returned 0x5a4880 [0049.148] GetProcessHeap () returned 0x560000 [0049.148] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.149] GetProcessHeap () returned 0x560000 [0049.149] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xddb0) returned 0x5a48b8 [0049.149] ReadFile (in: hFile=0x230, lpBuffer=0x5a48b8, nNumberOfBytesToRead=0xddb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a48b8*, lpNumberOfBytesRead=0x24ad7e8*=0xddb0, lpOverlapped=0x0) returned 1 [0049.150] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.150] WriteFile (in: hFile=0x230, lpBuffer=0x5a48b8*, nNumberOfBytesToWrite=0xddb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a48b8*, lpNumberOfBytesWritten=0x24ad7e4*=0xddb0, lpOverlapped=0x0) returned 1 [0049.151] GetProcessHeap () returned 0x560000 [0049.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a48b8 | out: hHeap=0x560000) returned 1 [0049.152] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.152] WriteFile (in: hFile=0x230, lpBuffer=0x5a4880*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4880*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.152] CloseHandle (hObject=0x230) returned 1 [0049.154] GetProcessHeap () returned 0x560000 [0049.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0049.154] GetProcessHeap () returned 0x560000 [0049.154] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.154] GetProcessHeap () returned 0x560000 [0049.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0049.155] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3" [0049.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3.badday" [0049.155] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\yzbwdty45.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\yzbwdty45.mp3.badday"), dwFlags=0x1) returned 1 [0049.155] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\YZbwDty45.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned 1 [0049.155] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="" [0049.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" [0049.155] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html")) returned 0x20 [0049.155] GetProcessHeap () returned 0x560000 [0049.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.155] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3211230, ftCreationTime.dwHighDateTime=0x1d4c6bb, ftLastAccessTime.dwLowDateTime=0x9f0831e0, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0x9f0831e0, ftLastWriteTime.dwHighDateTime=0x1d4cb9f, nFileSizeHigh=0x0, nFileSizeLow=0x13da1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_bl_0Mvk1NQJvK.wav", cAlternateFileName="_BL_0M~1.WAV")) returned 1 [0049.155] lstrcmpiW (lpString1="_bl_0Mvk1NQJvK.wav", lpString2=".") returned 1 [0049.155] lstrcmpiW (lpString1="_bl_0Mvk1NQJvK.wav", lpString2="..") returned 1 [0049.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="_bl_0Mvk1NQJvK.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav" [0049.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_bl_0Mvk1NQJvK.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0049.156] GetProcessHeap () returned 0x560000 [0049.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0049.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_bl_0Mvk1NQJvK.wav", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_bl_0Mvk1NQJvK.wav", lpUsedDefaultChar=0x0) returned 19 [0049.156] lstrlenA (lpString="_bl_0Mvk1NQJvK.wav") returned 18 [0049.156] lstrlenA (lpString=".badday") returned 7 [0049.156] lstrlenA (lpString=".badday") returned 7 [0049.156] lstrlenA (lpString="_bl_0Mvk1NQJvK.wav") returned 18 [0049.156] lstrcmpiA (lpString1="JvK.wav", lpString2=".badday") returned 1 [0049.156] lstrcmpiW (lpString1="_bl_0Mvk1NQJvK.wav", lpString2="how_to_back_files.html") returned -1 [0049.156] lstrcmpiW (lpString1="_bl_0Mvk1NQJvK.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0049.156] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.156] lstrcmpiW (lpString1="_bl_0Mvk1NQJvK.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0049.156] GetProcessHeap () returned 0x560000 [0049.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0049.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\_bl_0mvk1nqjvk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.156] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81313) returned 1 [0049.156] GetProcessHeap () returned 0x560000 [0049.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.156] GetProcessHeap () returned 0x560000 [0049.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0049.156] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav") returned 56 [0049.156] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.156] GetProcessHeap () returned 0x560000 [0049.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.157] GetProcessHeap () returned 0x560000 [0049.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a48b8 [0049.157] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.157] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a15e8) returned 1 [0049.157] CryptGenRandom (in: hProv=0x5a15e8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.157] CryptReleaseContext (hProv=0x5a15e8, dwFlags=0x0) returned 1 [0049.157] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.157] GetProcessHeap () returned 0x560000 [0049.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0049.157] lstrlenA (lpString="010001") returned 6 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0448 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1c48 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0790 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0049.158] GetProcessHeap () returned 0x560000 [0049.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1c48 | out: hHeap=0x560000) returned 1 [0049.158] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3528 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f90 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3528 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.159] GetProcessHeap () returned 0x560000 [0049.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.160] GetProcessHeap () returned 0x560000 [0049.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.160] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.161] GetProcessHeap () returned 0x560000 [0049.161] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.162] GetProcessHeap () returned 0x560000 [0049.162] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0049.163] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.164] GetProcessHeap () returned 0x560000 [0049.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0049.164] WriteFile (in: hFile=0x230, lpBuffer=0x5a48b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a48b8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.268] GetProcessHeap () returned 0x560000 [0049.268] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a48b8, Size=0x30) returned 0x5a48b8 [0049.268] GetProcessHeap () returned 0x560000 [0049.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.268] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.268] GetProcessHeap () returned 0x560000 [0049.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13da1) returned 0x5a48f0 [0049.269] ReadFile (in: hFile=0x230, lpBuffer=0x5a48f0, nNumberOfBytesToRead=0x13da1, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a48f0*, lpNumberOfBytesRead=0x24ad7e8*=0x13da1, lpOverlapped=0x0) returned 1 [0049.270] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.270] WriteFile (in: hFile=0x230, lpBuffer=0x5a48f0*, nNumberOfBytesToWrite=0x13da1, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a48f0*, lpNumberOfBytesWritten=0x24ad7e4*=0x13da1, lpOverlapped=0x0) returned 1 [0049.271] GetProcessHeap () returned 0x560000 [0049.271] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a48f0 | out: hHeap=0x560000) returned 1 [0049.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.272] WriteFile (in: hFile=0x230, lpBuffer=0x5a48b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a48b8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.273] CloseHandle (hObject=0x230) returned 1 [0049.276] GetProcessHeap () returned 0x560000 [0049.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0049.276] GetProcessHeap () returned 0x560000 [0049.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.276] GetProcessHeap () returned 0x560000 [0049.276] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0049.276] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav" [0049.276] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav.badday" [0049.276] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\_bl_0mvk1nqjvk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\_bl_0mvk1nqjvk.wav.badday"), dwFlags=0x1) returned 1 [0049.277] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\_bl_0Mvk1NQJvK.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY") returned 1 [0049.277] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY" | out: pszPath="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\") returned="" [0049.277] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" [0049.277] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\MjKsH57dDdaGklY\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\mjksh57dddagkly\\how_to_back_files.html")) returned 0x20 [0049.277] GetProcessHeap () returned 0x560000 [0049.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0049.277] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3211230, ftCreationTime.dwHighDateTime=0x1d4c6bb, ftLastAccessTime.dwLowDateTime=0x9f0831e0, ftLastAccessTime.dwHighDateTime=0x1d4cb9f, ftLastWriteTime.dwLowDateTime=0x9f0831e0, ftLastWriteTime.dwHighDateTime=0x1d4cb9f, nFileSizeHigh=0x0, nFileSizeLow=0x13da1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_bl_0Mvk1NQJvK.wav", cAlternateFileName="_BL_0M~1.WAV")) returned 0 [0049.277] FindClose (in: hFindFile=0x5797c8 | out: hFindFile=0x5797c8) returned 1 [0049.277] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\" [0049.277] GetProcessHeap () returned 0x560000 [0049.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585910 | out: hHeap=0x560000) returned 1 [0049.277] GetProcessHeap () returned 0x560000 [0049.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0049.277] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned 34 [0049.277] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\*" [0049.277] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24692850, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0x206a1790, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0x206a1790, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0049.278] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.278] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24692850, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0x206a1790, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0x206a1790, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.278] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.278] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.278] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976aa950, ftCreationTime.dwHighDateTime=0x1d4cab8, ftLastAccessTime.dwLowDateTime=0x9b1762b0, ftLastAccessTime.dwHighDateTime=0x1d4c74c, ftLastWriteTime.dwLowDateTime=0x9b1762b0, ftLastWriteTime.dwHighDateTime=0x1d4c74c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0IT0Nf14ZLed", cAlternateFileName="0IT0NF~1")) returned 1 [0049.278] lstrcmpiW (lpString1="0IT0Nf14ZLed", lpString2=".") returned 1 [0049.278] lstrcmpiW (lpString1="0IT0Nf14ZLed", lpString2="..") returned 1 [0049.278] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="0IT0Nf14ZLed" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed" [0049.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0IT0Nf14ZLed", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.278] GetProcessHeap () returned 0x560000 [0049.278] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0049.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0IT0Nf14ZLed", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0IT0Nf14ZLed", lpUsedDefaultChar=0x0) returned 13 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.278] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.279] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0IT0Nf14ZLed", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.280] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\" [0049.280] GetProcessHeap () returned 0x560000 [0049.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d8 [0049.280] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned 47 [0049.280] GetProcessHeap () returned 0x560000 [0049.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x60) returned 0x572a40 [0049.280] lstrcpyW (in: lpString1=0x572a40, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\" [0049.280] GetProcessHeap () returned 0x560000 [0049.280] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.280] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd83600c0, ftCreationTime.dwHighDateTime=0x1d4ca71, ftLastAccessTime.dwLowDateTime=0x494be7f0, ftLastAccessTime.dwHighDateTime=0x1d4cdd0, ftLastWriteTime.dwLowDateTime=0x494be7f0, ftLastWriteTime.dwHighDateTime=0x1d4cdd0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0kp4qjpzjBRulygy", cAlternateFileName="0KP4QJ~1")) returned 1 [0049.280] lstrcmpiW (lpString1="0kp4qjpzjBRulygy", lpString2=".") returned 1 [0049.280] lstrcmpiW (lpString1="0kp4qjpzjBRulygy", lpString2="..") returned 1 [0049.280] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="0kp4qjpzjBRulygy" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy" [0049.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0kp4qjpzjBRulygy", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0049.280] GetProcessHeap () returned 0x560000 [0049.280] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576a98 [0049.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0kp4qjpzjBRulygy", cchWideChar=-1, lpMultiByteStr=0x576a98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0kp4qjpzjBRulygy", lpUsedDefaultChar=0x0) returned 17 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.280] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.281] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="0kp4qjpzjBRulygy", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.283] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\" [0049.283] GetProcessHeap () returned 0x560000 [0049.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a198 [0049.283] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned 51 [0049.283] GetProcessHeap () returned 0x560000 [0049.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x68) returned 0x566e98 [0049.283] lstrcpyW (in: lpString1=0x566e98, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\" [0049.283] GetProcessHeap () returned 0x560000 [0049.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a98 | out: hHeap=0x560000) returned 1 [0049.284] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a03f0, ftCreationTime.dwHighDateTime=0x1d4d02c, ftLastAccessTime.dwLowDateTime=0x3701460, ftLastAccessTime.dwHighDateTime=0x1d4d323, ftLastWriteTime.dwLowDateTime=0x3701460, ftLastWriteTime.dwHighDateTime=0x1d4d323, nFileSizeHigh=0x0, nFileSizeLow=0x159b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="17V4L.m4a", cAlternateFileName="")) returned 1 [0049.284] lstrcmpiW (lpString1="17V4L.m4a", lpString2=".") returned 1 [0049.284] lstrcmpiW (lpString1="17V4L.m4a", lpString2="..") returned 1 [0049.284] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="17V4L.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a" [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="17V4L.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.284] GetProcessHeap () returned 0x560000 [0049.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="17V4L.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="17V4L.m4a", lpUsedDefaultChar=0x0) returned 10 [0049.284] lstrlenA (lpString="17V4L.m4a") returned 9 [0049.284] lstrlenA (lpString=".badday") returned 7 [0049.284] lstrlenA (lpString=".badday") returned 7 [0049.284] lstrlenA (lpString="17V4L.m4a") returned 9 [0049.284] lstrcmpiA (lpString1="V4L.m4a", lpString2=".badday") returned 1 [0049.284] lstrcmpiW (lpString1="17V4L.m4a", lpString2="how_to_back_files.html") returned -1 [0049.284] lstrcmpiW (lpString1="17V4L.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0049.284] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.284] lstrcmpiW (lpString1="17V4L.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0049.284] GetProcessHeap () returned 0x560000 [0049.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0049.284] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\17v4l.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.284] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=88497) returned 1 [0049.284] GetProcessHeap () returned 0x560000 [0049.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.284] GetProcessHeap () returned 0x560000 [0049.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0049.284] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a") returned 43 [0049.285] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.285] GetProcessHeap () returned 0x560000 [0049.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.285] GetProcessHeap () returned 0x560000 [0049.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38f) returned 0x5a48f0 [0049.286] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.286] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2198) returned 1 [0049.286] CryptGenRandom (in: hProv=0x5a2198, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.286] CryptReleaseContext (hProv=0x5a2198, dwFlags=0x0) returned 1 [0049.286] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.286] GetProcessHeap () returned 0x560000 [0049.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1cd0 [0049.286] lstrlenA (lpString="010001") returned 6 [0049.286] GetProcessHeap () returned 0x560000 [0049.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0049.286] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0d08 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a09c0 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3558 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.287] GetProcessHeap () returned 0x560000 [0049.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3648 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586e70 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3648 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.288] GetProcessHeap () returned 0x560000 [0049.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.289] GetProcessHeap () returned 0x560000 [0049.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.290] GetProcessHeap () returned 0x560000 [0049.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.290] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.291] GetProcessHeap () returned 0x560000 [0049.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.291] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3558 | out: hHeap=0x560000) returned 1 [0049.292] GetProcessHeap () returned 0x560000 [0049.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0049.293] GetProcessHeap () returned 0x560000 [0049.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0049.293] GetProcessHeap () returned 0x560000 [0049.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0049.293] GetProcessHeap () returned 0x560000 [0049.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0049.293] GetProcessHeap () returned 0x560000 [0049.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.293] GetProcessHeap () returned 0x560000 [0049.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1cd0 | out: hHeap=0x560000) returned 1 [0049.293] WriteFile (in: hFile=0x230, lpBuffer=0x5a48f0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a48f0*, lpNumberOfBytesWritten=0x24ad864*=0x38f, lpOverlapped=0x0) returned 1 [0049.295] GetProcessHeap () returned 0x560000 [0049.295] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a48f0, Size=0x30) returned 0x5a48f0 [0049.295] GetProcessHeap () returned 0x560000 [0049.295] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.295] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.296] GetProcessHeap () returned 0x560000 [0049.296] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x159c0) returned 0x5a4928 [0049.297] ReadFile (in: hFile=0x230, lpBuffer=0x5a4928, nNumberOfBytesToRead=0x159c0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4928*, lpNumberOfBytesRead=0x24ad7e8*=0x159c0, lpOverlapped=0x0) returned 1 [0049.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.299] WriteFile (in: hFile=0x230, lpBuffer=0x5a4928*, nNumberOfBytesToWrite=0x159c0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4928*, lpNumberOfBytesWritten=0x24ad7e4*=0x159c0, lpOverlapped=0x0) returned 1 [0049.301] GetProcessHeap () returned 0x560000 [0049.301] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4928 | out: hHeap=0x560000) returned 1 [0049.301] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.301] WriteFile (in: hFile=0x230, lpBuffer=0x5a48f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a48f0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.304] CloseHandle (hObject=0x230) returned 1 [0049.306] GetProcessHeap () returned 0x560000 [0049.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0049.306] GetProcessHeap () returned 0x560000 [0049.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.306] GetProcessHeap () returned 0x560000 [0049.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0049.306] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a" [0049.307] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a.badday" [0049.307] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\17v4l.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\17v4l.m4a.badday"), dwFlags=0x1) returned 1 [0049.307] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\17V4L.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv") returned 1 [0049.307] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned="" [0049.307] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" [0049.307] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\how_to_back_files.html")) returned 0xffffffff [0049.307] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0049.308] GetProcessHeap () returned 0x560000 [0049.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.308] GetProcessHeap () returned 0x560000 [0049.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.323] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.326] GetProcessHeap () returned 0x560000 [0049.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.326] GetProcessHeap () returned 0x560000 [0049.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0049.326] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0049.326] GetProcessHeap () returned 0x560000 [0049.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.326] GetProcessHeap () returned 0x560000 [0049.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.334] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.335] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.409] GetProcessHeap () returned 0x560000 [0049.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.409] GetProcessHeap () returned 0x560000 [0049.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0049.409] CloseHandle (hObject=0x230) returned 1 [0049.409] GetProcessHeap () returned 0x560000 [0049.409] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.409] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9cc4730, ftCreationTime.dwHighDateTime=0x1d4cdeb, ftLastAccessTime.dwLowDateTime=0xf2dfa270, ftLastAccessTime.dwHighDateTime=0x1d4ca6f, ftLastWriteTime.dwLowDateTime=0xf2dfa270, ftLastWriteTime.dwHighDateTime=0x1d4ca6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eZ7MU-92EIvok", cAlternateFileName="EZ7MU-~1")) returned 1 [0049.409] lstrcmpiW (lpString1="eZ7MU-92EIvok", lpString2=".") returned 1 [0049.409] lstrcmpiW (lpString1="eZ7MU-92EIvok", lpString2="..") returned 1 [0049.409] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="eZ7MU-92EIvok" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok" [0049.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eZ7MU-92EIvok", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.410] GetProcessHeap () returned 0x560000 [0049.410] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0049.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eZ7MU-92EIvok", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eZ7MU-92EIvok", lpUsedDefaultChar=0x0) returned 14 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.410] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.411] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="eZ7MU-92EIvok", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.411] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\" [0049.411] GetProcessHeap () returned 0x560000 [0049.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0049.411] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned 48 [0049.411] GetProcessHeap () returned 0x560000 [0049.411] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x62) returned 0x56f490 [0049.411] lstrcpyW (in: lpString1=0x56f490, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\" [0049.411] GetProcessHeap () returned 0x560000 [0049.411] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.411] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99751d10, ftCreationTime.dwHighDateTime=0x1d4d2c0, ftLastAccessTime.dwLowDateTime=0xd432980, ftLastAccessTime.dwHighDateTime=0x1d4ccd6, ftLastWriteTime.dwLowDateTime=0xd432980, ftLastWriteTime.dwHighDateTime=0x1d4ccd6, nFileSizeHigh=0x0, nFileSizeLow=0xb53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShCUCPX1Tm3nyp.m4a", cAlternateFileName="SHCUCP~1.M4A")) returned 1 [0049.411] lstrcmpiW (lpString1="ShCUCPX1Tm3nyp.m4a", lpString2=".") returned 1 [0049.411] lstrcmpiW (lpString1="ShCUCPX1Tm3nyp.m4a", lpString2="..") returned 1 [0049.411] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="ShCUCPX1Tm3nyp.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a" [0049.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ShCUCPX1Tm3nyp.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0049.412] GetProcessHeap () returned 0x560000 [0049.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x576878 [0049.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ShCUCPX1Tm3nyp.m4a", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShCUCPX1Tm3nyp.m4a", lpUsedDefaultChar=0x0) returned 19 [0049.412] lstrlenA (lpString="ShCUCPX1Tm3nyp.m4a") returned 18 [0049.412] lstrlenA (lpString=".badday") returned 7 [0049.412] lstrlenA (lpString=".badday") returned 7 [0049.412] lstrlenA (lpString="ShCUCPX1Tm3nyp.m4a") returned 18 [0049.412] lstrcmpiA (lpString1="nyp.m4a", lpString2=".badday") returned 1 [0049.412] lstrcmpiW (lpString1="ShCUCPX1Tm3nyp.m4a", lpString2="how_to_back_files.html") returned 1 [0049.412] lstrcmpiW (lpString1="ShCUCPX1Tm3nyp.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.412] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.412] lstrcmpiW (lpString1="ShCUCPX1Tm3nyp.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0049.412] GetProcessHeap () returned 0x560000 [0049.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0049.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\shcucpx1tm3nyp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.412] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=46394) returned 1 [0049.412] GetProcessHeap () returned 0x560000 [0049.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x589f20 [0049.412] GetProcessHeap () returned 0x560000 [0049.412] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0049.412] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a") returned 52 [0049.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.412] GetProcessHeap () returned 0x560000 [0049.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.413] GetProcessHeap () returned 0x560000 [0049.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4928 [0049.413] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.413] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1a28) returned 1 [0049.413] CryptGenRandom (in: hProv=0x5a1a28, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.413] CryptReleaseContext (hProv=0x5a1a28, dwFlags=0x0) returned 1 [0049.413] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.413] GetProcessHeap () returned 0x560000 [0049.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0049.413] lstrlenA (lpString="010001") returned 6 [0049.413] GetProcessHeap () returned 0x560000 [0049.413] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0049.413] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0e20 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0560 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0049.414] GetProcessHeap () returned 0x560000 [0049.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0049.414] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3750 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587530 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3750 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.415] GetProcessHeap () returned 0x560000 [0049.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.415] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.416] GetProcessHeap () returned 0x560000 [0049.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.417] GetProcessHeap () returned 0x560000 [0049.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.418] GetProcessHeap () returned 0x560000 [0049.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.419] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.420] GetProcessHeap () returned 0x560000 [0049.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0049.420] WriteFile (in: hFile=0x230, lpBuffer=0x5a4928*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4928*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.485] GetProcessHeap () returned 0x560000 [0049.485] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4928, Size=0x30) returned 0x5a4928 [0049.485] GetProcessHeap () returned 0x560000 [0049.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.485] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.485] GetProcessHeap () returned 0x560000 [0049.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb53a) returned 0x5a4960 [0049.485] ReadFile (in: hFile=0x230, lpBuffer=0x5a4960, nNumberOfBytesToRead=0xb53a, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4960*, lpNumberOfBytesRead=0x24ad7e8*=0xb53a, lpOverlapped=0x0) returned 1 [0049.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.486] WriteFile (in: hFile=0x230, lpBuffer=0x5a4960*, nNumberOfBytesToWrite=0xb53a, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4960*, lpNumberOfBytesWritten=0x24ad7e4*=0xb53a, lpOverlapped=0x0) returned 1 [0049.489] GetProcessHeap () returned 0x560000 [0049.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4960 | out: hHeap=0x560000) returned 1 [0049.489] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.489] WriteFile (in: hFile=0x230, lpBuffer=0x5a4928*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4928*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.491] CloseHandle (hObject=0x230) returned 1 [0049.493] GetProcessHeap () returned 0x560000 [0049.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0049.494] GetProcessHeap () returned 0x560000 [0049.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0049.494] GetProcessHeap () returned 0x560000 [0049.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0049.494] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a" [0049.494] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a.badday" [0049.494] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\shcucpx1tm3nyp.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\shcucpx1tm3nyp.m4a.badday"), dwFlags=0x1) returned 1 [0049.494] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ShCUCPX1Tm3nyp.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv") returned 1 [0049.494] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned="" [0049.494] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" [0049.494] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\how_to_back_files.html")) returned 0x20 [0049.495] GetProcessHeap () returned 0x560000 [0049.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0049.495] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8251ce0, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x40e5220, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0x40e5220, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x7e41, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ydylpC67BxA8VJUuq.mp3", cAlternateFileName="YDYLPC~1.MP3")) returned 1 [0049.495] lstrcmpiW (lpString1="ydylpC67BxA8VJUuq.mp3", lpString2=".") returned 1 [0049.495] lstrcmpiW (lpString1="ydylpC67BxA8VJUuq.mp3", lpString2="..") returned 1 [0049.495] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="ydylpC67BxA8VJUuq.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3" [0049.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ydylpC67BxA8VJUuq.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.495] GetProcessHeap () returned 0x560000 [0049.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576a58 [0049.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ydylpC67BxA8VJUuq.mp3", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ydylpC67BxA8VJUuq.mp3", lpUsedDefaultChar=0x0) returned 22 [0049.495] lstrlenA (lpString="ydylpC67BxA8VJUuq.mp3") returned 21 [0049.495] lstrlenA (lpString=".badday") returned 7 [0049.495] lstrlenA (lpString=".badday") returned 7 [0049.495] lstrlenA (lpString="ydylpC67BxA8VJUuq.mp3") returned 21 [0049.495] lstrcmpiA (lpString1="Uuq.mp3", lpString2=".badday") returned 1 [0049.495] lstrcmpiW (lpString1="ydylpC67BxA8VJUuq.mp3", lpString2="how_to_back_files.html") returned 1 [0049.495] lstrcmpiW (lpString1="ydylpC67BxA8VJUuq.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.495] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.495] lstrcmpiW (lpString1="ydylpC67BxA8VJUuq.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0049.495] GetProcessHeap () returned 0x560000 [0049.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0049.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ydylpc67bxa8vjuuq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.495] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=32321) returned 1 [0049.495] GetProcessHeap () returned 0x560000 [0049.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x589f20 [0049.495] GetProcessHeap () returned 0x560000 [0049.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0049.496] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3") returned 55 [0049.496] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.496] GetProcessHeap () returned 0x560000 [0049.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.496] GetProcessHeap () returned 0x560000 [0049.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4960 [0049.496] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.496] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1bc0) returned 1 [0049.496] CryptGenRandom (in: hProv=0x5a1bc0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.496] CryptReleaseContext (hProv=0x5a1bc0, dwFlags=0x0) returned 1 [0049.496] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.496] GetProcessHeap () returned 0x560000 [0049.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0049.497] lstrlenA (lpString="010001") returned 6 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586690 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a08a8 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0678 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0049.497] GetProcessHeap () returned 0x560000 [0049.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3690 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587140 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3690 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.498] GetProcessHeap () returned 0x560000 [0049.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.499] GetProcessHeap () returned 0x560000 [0049.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.500] GetProcessHeap () returned 0x560000 [0049.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.500] GetProcessHeap () returned 0x560000 [0049.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.501] GetProcessHeap () returned 0x560000 [0049.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.501] GetProcessHeap () returned 0x560000 [0049.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.501] GetProcessHeap () returned 0x560000 [0049.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.501] GetProcessHeap () returned 0x560000 [0049.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.501] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.502] GetProcessHeap () returned 0x560000 [0049.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.502] GetProcessHeap () returned 0x560000 [0049.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0049.503] GetProcessHeap () returned 0x560000 [0049.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0049.504] GetProcessHeap () returned 0x560000 [0049.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0049.504] GetProcessHeap () returned 0x560000 [0049.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0049.504] GetProcessHeap () returned 0x560000 [0049.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0049.504] GetProcessHeap () returned 0x560000 [0049.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0049.504] GetProcessHeap () returned 0x560000 [0049.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.504] GetProcessHeap () returned 0x560000 [0049.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0049.504] WriteFile (in: hFile=0x230, lpBuffer=0x5a4960*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4960*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.507] GetProcessHeap () returned 0x560000 [0049.507] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4960, Size=0x30) returned 0x5a4960 [0049.507] GetProcessHeap () returned 0x560000 [0049.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.507] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.508] GetProcessHeap () returned 0x560000 [0049.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7e41) returned 0x5a4998 [0049.508] ReadFile (in: hFile=0x230, lpBuffer=0x5a4998, nNumberOfBytesToRead=0x7e41, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4998*, lpNumberOfBytesRead=0x24ad7e8*=0x7e41, lpOverlapped=0x0) returned 1 [0049.508] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.508] WriteFile (in: hFile=0x230, lpBuffer=0x5a4998*, nNumberOfBytesToWrite=0x7e41, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4998*, lpNumberOfBytesWritten=0x24ad7e4*=0x7e41, lpOverlapped=0x0) returned 1 [0049.509] GetProcessHeap () returned 0x560000 [0049.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4998 | out: hHeap=0x560000) returned 1 [0049.511] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.511] WriteFile (in: hFile=0x230, lpBuffer=0x5a4960*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4960*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.512] CloseHandle (hObject=0x230) returned 1 [0049.514] GetProcessHeap () returned 0x560000 [0049.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0049.514] GetProcessHeap () returned 0x560000 [0049.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589f20 | out: hHeap=0x560000) returned 1 [0049.514] GetProcessHeap () returned 0x560000 [0049.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0049.514] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3" [0049.514] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3.badday" [0049.514] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ydylpc67bxa8vjuuq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ydylpc67bxa8vjuuq.mp3.badday"), dwFlags=0x1) returned 1 [0049.514] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\ydylpC67BxA8VJUuq.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv") returned 1 [0049.514] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\") returned="" [0049.515] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" [0049.515] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\how_to_back_files.html")) returned 0x20 [0049.515] GetProcessHeap () returned 0x560000 [0049.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0049.515] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8251ce0, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x40e5220, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0x40e5220, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x7e41, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ydylpC67BxA8VJUuq.mp3", cAlternateFileName="YDYLPC~1.MP3")) returned 0 [0049.515] FindClose (in: hFindFile=0x5797c8 | out: hFindFile=0x5797c8) returned 1 [0049.515] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\" [0049.515] GetProcessHeap () returned 0x560000 [0049.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.515] GetProcessHeap () returned 0x560000 [0049.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.515] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned 48 [0049.515] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\*" [0049.515] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9cc4730, ftCreationTime.dwHighDateTime=0x1d4cdeb, ftLastAccessTime.dwLowDateTime=0xf2dfa270, ftLastAccessTime.dwHighDateTime=0x1d4ca6f, ftLastWriteTime.dwLowDateTime=0xf2dfa270, ftLastWriteTime.dwHighDateTime=0x1d4ca6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0049.515] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.515] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9cc4730, ftCreationTime.dwHighDateTime=0x1d4cdeb, ftLastAccessTime.dwLowDateTime=0xf2dfa270, ftLastAccessTime.dwHighDateTime=0x1d4ca6f, ftLastWriteTime.dwLowDateTime=0xf2dfa270, ftLastWriteTime.dwHighDateTime=0x1d4ca6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.515] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.515] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.515] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf07c89d0, ftCreationTime.dwHighDateTime=0x1d4d55f, ftLastAccessTime.dwLowDateTime=0x7775b5d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9c, ftLastWriteTime.dwLowDateTime=0x7775b5d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9c, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i0-C.m4a", cAlternateFileName="")) returned 1 [0049.515] lstrcmpiW (lpString1="i0-C.m4a", lpString2=".") returned 1 [0049.515] lstrcmpiW (lpString1="i0-C.m4a", lpString2="..") returned 1 [0049.515] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="i0-C.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a" [0049.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i0-C.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.516] GetProcessHeap () returned 0x560000 [0049.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0049.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i0-C.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i0-C.m4a", lpUsedDefaultChar=0x0) returned 9 [0049.516] lstrlenA (lpString="i0-C.m4a") returned 8 [0049.516] lstrlenA (lpString=".badday") returned 7 [0049.516] lstrlenA (lpString=".badday") returned 7 [0049.516] lstrlenA (lpString="i0-C.m4a") returned 8 [0049.516] lstrcmpiA (lpString1="0-C.m4a", lpString2=".badday") returned 1 [0049.516] lstrcmpiW (lpString1="i0-C.m4a", lpString2="how_to_back_files.html") returned 1 [0049.516] lstrcmpiW (lpString1="i0-C.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0049.516] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0049.516] lstrcmpiW (lpString1="i0-C.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0049.516] GetProcessHeap () returned 0x560000 [0049.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0049.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\i0-c.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.516] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=74240) returned 1 [0049.516] GetProcessHeap () returned 0x560000 [0049.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.516] GetProcessHeap () returned 0x560000 [0049.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0049.517] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a") returned 56 [0049.517] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.517] GetProcessHeap () returned 0x560000 [0049.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0049.517] GetProcessHeap () returned 0x560000 [0049.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4998 [0049.518] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.518] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1e68) returned 1 [0049.518] CryptGenRandom (in: hProv=0x5a1e68, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0049.518] CryptReleaseContext (hProv=0x5a1e68, dwFlags=0x0) returned 1 [0049.518] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0049.518] GetProcessHeap () returned 0x560000 [0049.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0049.518] lstrlenA (lpString="010001") returned 6 [0049.518] GetProcessHeap () returned 0x560000 [0049.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0f38 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1050 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a35a0 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0049.519] GetProcessHeap () returned 0x560000 [0049.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0049.519] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a34e0 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587380 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a34e0 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.520] GetProcessHeap () returned 0x560000 [0049.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.520] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.521] GetProcessHeap () returned 0x560000 [0049.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.521] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.522] GetProcessHeap () returned 0x560000 [0049.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.522] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.523] GetProcessHeap () returned 0x560000 [0049.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0049.523] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0049.524] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a35a0 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0049.525] GetProcessHeap () returned 0x560000 [0049.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0049.525] WriteFile (in: hFile=0x230, lpBuffer=0x5a4998*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4998*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0049.527] GetProcessHeap () returned 0x560000 [0049.527] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4998, Size=0x30) returned 0x5a4998 [0049.527] GetProcessHeap () returned 0x560000 [0049.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0049.527] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.527] GetProcessHeap () returned 0x560000 [0049.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12200) returned 0x5a49d0 [0049.528] ReadFile (in: hFile=0x230, lpBuffer=0x5a49d0, nNumberOfBytesToRead=0x12200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a49d0*, lpNumberOfBytesRead=0x24ad7e8*=0x12200, lpOverlapped=0x0) returned 1 [0049.529] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.529] WriteFile (in: hFile=0x230, lpBuffer=0x5a49d0*, nNumberOfBytesToWrite=0x12200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a49d0*, lpNumberOfBytesWritten=0x24ad7e4*=0x12200, lpOverlapped=0x0) returned 1 [0049.540] GetProcessHeap () returned 0x560000 [0049.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a49d0 | out: hHeap=0x560000) returned 1 [0049.542] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0049.542] WriteFile (in: hFile=0x230, lpBuffer=0x5a4998*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4998*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0049.543] CloseHandle (hObject=0x230) returned 1 [0049.545] GetProcessHeap () returned 0x560000 [0049.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0049.546] GetProcessHeap () returned 0x560000 [0049.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.546] GetProcessHeap () returned 0x560000 [0049.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0049.546] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a" [0049.546] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a.badday" [0049.546] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\i0-c.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\i0-c.m4a.badday"), dwFlags=0x1) returned 1 [0049.546] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\i0-C.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok") returned 1 [0049.546] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="" [0049.546] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" [0049.547] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\how_to_back_files.html")) returned 0xffffffff [0049.547] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0049.548] GetProcessHeap () returned 0x560000 [0049.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.548] GetProcessHeap () returned 0x560000 [0049.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0049.554] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.555] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.556] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.560] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.563] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.563] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.563] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.563] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.577] GetProcessHeap () returned 0x560000 [0049.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0049.578] GetProcessHeap () returned 0x560000 [0049.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0049.578] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0049.578] GetProcessHeap () returned 0x560000 [0049.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0049.578] GetProcessHeap () returned 0x560000 [0049.578] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.588] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.589] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.590] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.086] GetProcessHeap () returned 0x560000 [0050.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.086] GetProcessHeap () returned 0x560000 [0050.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0050.086] CloseHandle (hObject=0x230) returned 1 [0050.087] GetProcessHeap () returned 0x560000 [0050.087] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3af5360, ftCreationTime.dwHighDateTime=0x1d4cbc0, ftLastAccessTime.dwLowDateTime=0x6e7f04b0, ftLastAccessTime.dwHighDateTime=0x1d4c8b9, ftLastWriteTime.dwLowDateTime=0x6e7f04b0, ftLastWriteTime.dwHighDateTime=0x1d4c8b9, nFileSizeHigh=0x0, nFileSizeLow=0x7f71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LS7 4Kwl5n8K6inM-QM.mp3", cAlternateFileName="LS74KW~1.MP3")) returned 1 [0050.087] lstrcmpiW (lpString1="LS7 4Kwl5n8K6inM-QM.mp3", lpString2=".") returned 1 [0050.087] lstrcmpiW (lpString1="LS7 4Kwl5n8K6inM-QM.mp3", lpString2="..") returned 1 [0050.087] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="LS7 4Kwl5n8K6inM-QM.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3" [0050.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LS7 4Kwl5n8K6inM-QM.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.087] GetProcessHeap () returned 0x560000 [0050.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5769f8 [0050.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LS7 4Kwl5n8K6inM-QM.mp3", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LS7 4Kwl5n8K6inM-QM.mp3", lpUsedDefaultChar=0x0) returned 24 [0050.087] lstrlenA (lpString="LS7 4Kwl5n8K6inM-QM.mp3") returned 23 [0050.087] lstrlenA (lpString=".badday") returned 7 [0050.087] lstrlenA (lpString=".badday") returned 7 [0050.087] lstrlenA (lpString="LS7 4Kwl5n8K6inM-QM.mp3") returned 23 [0050.087] lstrcmpiA (lpString1="-QM.mp3", lpString2=".badday") returned 1 [0050.087] lstrcmpiW (lpString1="LS7 4Kwl5n8K6inM-QM.mp3", lpString2="how_to_back_files.html") returned 1 [0050.087] lstrcmpiW (lpString1="LS7 4Kwl5n8K6inM-QM.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.087] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.087] lstrcmpiW (lpString1="LS7 4Kwl5n8K6inM-QM.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.087] GetProcessHeap () returned 0x560000 [0050.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0050.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\ls7 4kwl5n8k6inm-qm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.087] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=32625) returned 1 [0050.087] GetProcessHeap () returned 0x560000 [0050.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.088] GetProcessHeap () returned 0x560000 [0050.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0050.088] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3") returned 71 [0050.088] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.088] GetProcessHeap () returned 0x560000 [0050.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.088] GetProcessHeap () returned 0x560000 [0050.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a49d0 [0050.089] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.089] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1890) returned 1 [0050.089] CryptGenRandom (in: hProv=0x5a1890, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.089] CryptReleaseContext (hProv=0x5a1890, dwFlags=0x0) returned 1 [0050.089] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.089] GetProcessHeap () returned 0x560000 [0050.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0050.089] lstrlenA (lpString="010001") returned 6 [0050.089] GetProcessHeap () returned 0x560000 [0050.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0050.089] GetProcessHeap () returned 0x560000 [0050.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0050.089] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0d08 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a08a8 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a35b8 [0050.090] GetProcessHeap () returned 0x560000 [0050.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.090] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586e70 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a35b8 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.091] GetProcessHeap () returned 0x560000 [0050.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.092] GetProcessHeap () returned 0x560000 [0050.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.093] GetProcessHeap () returned 0x560000 [0050.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.094] GetProcessHeap () returned 0x560000 [0050.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.096] GetProcessHeap () returned 0x560000 [0050.096] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.097] GetProcessHeap () returned 0x560000 [0050.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0050.097] WriteFile (in: hFile=0x230, lpBuffer=0x5a49d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a49d0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.192] GetProcessHeap () returned 0x560000 [0050.192] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a49d0, Size=0x30) returned 0x5a49d0 [0050.192] GetProcessHeap () returned 0x560000 [0050.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.192] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.192] GetProcessHeap () returned 0x560000 [0050.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7f71) returned 0x5a4a08 [0050.192] ReadFile (in: hFile=0x230, lpBuffer=0x5a4a08, nNumberOfBytesToRead=0x7f71, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4a08*, lpNumberOfBytesRead=0x24ad7e8*=0x7f71, lpOverlapped=0x0) returned 1 [0050.193] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.193] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a08*, nNumberOfBytesToWrite=0x7f71, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4a08*, lpNumberOfBytesWritten=0x24ad7e4*=0x7f71, lpOverlapped=0x0) returned 1 [0050.194] GetProcessHeap () returned 0x560000 [0050.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4a08 | out: hHeap=0x560000) returned 1 [0050.194] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.194] WriteFile (in: hFile=0x230, lpBuffer=0x5a49d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a49d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.195] CloseHandle (hObject=0x230) returned 1 [0050.197] GetProcessHeap () returned 0x560000 [0050.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0050.197] GetProcessHeap () returned 0x560000 [0050.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.197] GetProcessHeap () returned 0x560000 [0050.197] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0050.197] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3" [0050.197] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3.badday" [0050.197] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\ls7 4kwl5n8k6inm-qm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\ls7 4kwl5n8k6inm-qm.mp3.badday"), dwFlags=0x1) returned 1 [0050.198] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\LS7 4Kwl5n8K6inM-QM.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok") returned 1 [0050.198] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="" [0050.198] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" [0050.198] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\how_to_back_files.html")) returned 0x20 [0050.198] GetProcessHeap () returned 0x560000 [0050.198] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0050.198] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9481ab0, ftCreationTime.dwHighDateTime=0x1d4cb13, ftLastAccessTime.dwLowDateTime=0xa1e55de0, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xa1e55de0, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x185ef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O9Jv0mJjMt4lQO_5.mp3", cAlternateFileName="O9JV0M~1.MP3")) returned 1 [0050.198] lstrcmpiW (lpString1="O9Jv0mJjMt4lQO_5.mp3", lpString2=".") returned 1 [0050.198] lstrcmpiW (lpString1="O9Jv0mJjMt4lQO_5.mp3", lpString2="..") returned 1 [0050.198] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="O9Jv0mJjMt4lQO_5.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3" [0050.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O9Jv0mJjMt4lQO_5.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0050.198] GetProcessHeap () returned 0x560000 [0050.198] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x5768d8 [0050.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O9Jv0mJjMt4lQO_5.mp3", cchWideChar=-1, lpMultiByteStr=0x5768d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="O9Jv0mJjMt4lQO_5.mp3", lpUsedDefaultChar=0x0) returned 21 [0050.199] lstrlenA (lpString="O9Jv0mJjMt4lQO_5.mp3") returned 20 [0050.199] lstrlenA (lpString=".badday") returned 7 [0050.199] lstrlenA (lpString=".badday") returned 7 [0050.199] lstrlenA (lpString="O9Jv0mJjMt4lQO_5.mp3") returned 20 [0050.199] lstrcmpiA (lpString1="O_5.mp3", lpString2=".badday") returned 1 [0050.199] lstrcmpiW (lpString1="O9Jv0mJjMt4lQO_5.mp3", lpString2="how_to_back_files.html") returned 1 [0050.199] lstrcmpiW (lpString1="O9Jv0mJjMt4lQO_5.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.199] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.199] lstrcmpiW (lpString1="O9Jv0mJjMt4lQO_5.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.199] GetProcessHeap () returned 0x560000 [0050.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0050.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\o9jv0mjjmt4lqo_5.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.199] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=99823) returned 1 [0050.199] GetProcessHeap () returned 0x560000 [0050.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.199] GetProcessHeap () returned 0x560000 [0050.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0050.199] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3") returned 68 [0050.199] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.199] GetProcessHeap () returned 0x560000 [0050.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.199] GetProcessHeap () returned 0x560000 [0050.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x5a4a08 [0050.199] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.199] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2198) returned 1 [0050.200] CryptGenRandom (in: hProv=0x5a2198, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.200] CryptReleaseContext (hProv=0x5a2198, dwFlags=0x0) returned 1 [0050.200] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1cd0 [0050.200] lstrlenA (lpString="010001") returned 6 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0d08 [0050.200] GetProcessHeap () returned 0x560000 [0050.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a14d8 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0560 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a14d8 | out: hHeap=0x560000) returned 1 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a36c0 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5868d0 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a36c0 | out: hHeap=0x560000) returned 1 [0050.201] GetProcessHeap () returned 0x560000 [0050.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.202] GetProcessHeap () returned 0x560000 [0050.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.203] GetProcessHeap () returned 0x560000 [0050.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.203] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.204] GetProcessHeap () returned 0x560000 [0050.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.204] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.205] GetProcessHeap () returned 0x560000 [0050.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.205] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0050.206] GetProcessHeap () returned 0x560000 [0050.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.207] GetProcessHeap () returned 0x560000 [0050.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.207] GetProcessHeap () returned 0x560000 [0050.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1cd0 | out: hHeap=0x560000) returned 1 [0050.207] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a08*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4a08*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0050.210] GetProcessHeap () returned 0x560000 [0050.210] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4a08, Size=0x30) returned 0x5a4a08 [0050.210] GetProcessHeap () returned 0x560000 [0050.210] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.210] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.210] GetProcessHeap () returned 0x560000 [0050.210] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x185f0) returned 0x5a4a40 [0050.211] ReadFile (in: hFile=0x230, lpBuffer=0x5a4a40, nNumberOfBytesToRead=0x185f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4a40*, lpNumberOfBytesRead=0x24ad7e8*=0x185f0, lpOverlapped=0x0) returned 1 [0050.213] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.213] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a40*, nNumberOfBytesToWrite=0x185f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4a40*, lpNumberOfBytesWritten=0x24ad7e4*=0x185f0, lpOverlapped=0x0) returned 1 [0050.214] GetProcessHeap () returned 0x560000 [0050.214] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4a40 | out: hHeap=0x560000) returned 1 [0050.214] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.215] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4a08*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.215] CloseHandle (hObject=0x230) returned 1 [0050.218] GetProcessHeap () returned 0x560000 [0050.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0050.218] GetProcessHeap () returned 0x560000 [0050.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.218] GetProcessHeap () returned 0x560000 [0050.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0050.218] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3" [0050.218] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3.badday" [0050.218] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\o9jv0mjjmt4lqo_5.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\o9jv0mjjmt4lqo_5.mp3.badday"), dwFlags=0x1) returned 1 [0050.230] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\O9Jv0mJjMt4lQO_5.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok") returned 1 [0050.230] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="" [0050.230] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" [0050.230] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\how_to_back_files.html")) returned 0x20 [0050.230] GetProcessHeap () returned 0x560000 [0050.230] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5768d8 | out: hHeap=0x560000) returned 1 [0050.230] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9884b0, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0xb00a08f0, ftLastAccessTime.dwHighDateTime=0x1d4d091, ftLastWriteTime.dwLowDateTime=0xb00a08f0, ftLastWriteTime.dwHighDateTime=0x1d4d091, nFileSizeHigh=0x0, nFileSizeLow=0x727c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xf877UpwmBv_.m4a", cAlternateFileName="XF877U~1.M4A")) returned 1 [0050.230] lstrcmpiW (lpString1="xf877UpwmBv_.m4a", lpString2=".") returned 1 [0050.230] lstrcmpiW (lpString1="xf877UpwmBv_.m4a", lpString2="..") returned 1 [0050.230] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="xf877UpwmBv_.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a" [0050.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xf877UpwmBv_.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0050.230] GetProcessHeap () returned 0x560000 [0050.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x5767f8 [0050.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xf877UpwmBv_.m4a", cchWideChar=-1, lpMultiByteStr=0x5767f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xf877UpwmBv_.m4a", lpUsedDefaultChar=0x0) returned 17 [0050.230] lstrlenA (lpString="xf877UpwmBv_.m4a") returned 16 [0050.230] lstrlenA (lpString=".badday") returned 7 [0050.230] lstrlenA (lpString=".badday") returned 7 [0050.230] lstrlenA (lpString="xf877UpwmBv_.m4a") returned 16 [0050.230] lstrcmpiA (lpString1="Bv_.m4a", lpString2=".badday") returned 1 [0050.230] lstrcmpiW (lpString1="xf877UpwmBv_.m4a", lpString2="how_to_back_files.html") returned 1 [0050.230] lstrcmpiW (lpString1="xf877UpwmBv_.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.230] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.230] lstrcmpiW (lpString1="xf877UpwmBv_.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.230] GetProcessHeap () returned 0x560000 [0050.230] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3f0 [0050.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\xf877upwmbv_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.231] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=29308) returned 1 [0050.231] GetProcessHeap () returned 0x560000 [0050.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.231] GetProcessHeap () returned 0x560000 [0050.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0050.231] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a") returned 64 [0050.231] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.231] GetProcessHeap () returned 0x560000 [0050.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.231] GetProcessHeap () returned 0x560000 [0050.231] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4a40 [0050.231] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.231] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1d58) returned 1 [0050.231] CryptGenRandom (in: hProv=0x5a1d58, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.232] CryptReleaseContext (hProv=0x5a1d58, dwFlags=0x0) returned 1 [0050.232] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0050.232] lstrlenA (lpString="010001") returned 6 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0d08 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0e20 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.232] GetProcessHeap () returned 0x560000 [0050.232] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3468 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586600 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3468 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.233] GetProcessHeap () returned 0x560000 [0050.233] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.233] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.234] GetProcessHeap () returned 0x560000 [0050.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.235] GetProcessHeap () returned 0x560000 [0050.235] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.236] GetProcessHeap () returned 0x560000 [0050.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.236] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.237] GetProcessHeap () returned 0x560000 [0050.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.237] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.238] GetProcessHeap () returned 0x560000 [0050.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0050.239] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4a40*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.241] GetProcessHeap () returned 0x560000 [0050.241] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4a40, Size=0x30) returned 0x5a4a40 [0050.241] GetProcessHeap () returned 0x560000 [0050.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.241] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.241] GetProcessHeap () returned 0x560000 [0050.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x727c) returned 0x5a4a78 [0050.241] ReadFile (in: hFile=0x230, lpBuffer=0x5a4a78, nNumberOfBytesToRead=0x727c, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4a78*, lpNumberOfBytesRead=0x24ad7e8*=0x727c, lpOverlapped=0x0) returned 1 [0050.241] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.242] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a78*, nNumberOfBytesToWrite=0x727c, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4a78*, lpNumberOfBytesWritten=0x24ad7e4*=0x727c, lpOverlapped=0x0) returned 1 [0050.243] GetProcessHeap () returned 0x560000 [0050.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4a78 | out: hHeap=0x560000) returned 1 [0050.244] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.244] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4a40*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.245] CloseHandle (hObject=0x230) returned 1 [0050.246] GetProcessHeap () returned 0x560000 [0050.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3f0 | out: hHeap=0x560000) returned 1 [0050.246] GetProcessHeap () returned 0x560000 [0050.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.246] GetProcessHeap () returned 0x560000 [0050.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0050.246] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a" [0050.247] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a.badday" [0050.247] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\xf877upwmbv_.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\xf877upwmbv_.m4a.badday"), dwFlags=0x1) returned 1 [0050.247] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\xf877UpwmBv_.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok") returned 1 [0050.247] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\") returned="" [0050.247] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" [0050.247] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\eZ7MU-92EIvok\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\ez7mu-92eivok\\how_to_back_files.html")) returned 0x20 [0050.247] GetProcessHeap () returned 0x560000 [0050.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5767f8 | out: hHeap=0x560000) returned 1 [0050.247] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9884b0, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0xb00a08f0, ftLastAccessTime.dwHighDateTime=0x1d4d091, ftLastWriteTime.dwLowDateTime=0xb00a08f0, ftLastWriteTime.dwHighDateTime=0x1d4d091, nFileSizeHigh=0x0, nFileSizeLow=0x727c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xf877UpwmBv_.m4a", cAlternateFileName="XF877U~1.M4A")) returned 0 [0050.247] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0050.247] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\" [0050.247] GetProcessHeap () returned 0x560000 [0050.247] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x566e98 | out: hHeap=0x560000) returned 1 [0050.247] GetProcessHeap () returned 0x560000 [0050.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.248] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned 51 [0050.248] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\*" [0050.248] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd83600c0, ftCreationTime.dwHighDateTime=0x1d4ca71, ftLastAccessTime.dwLowDateTime=0x494be7f0, ftLastAccessTime.dwHighDateTime=0x1d4cdd0, ftLastWriteTime.dwLowDateTime=0x494be7f0, ftLastWriteTime.dwHighDateTime=0x1d4cdd0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0050.248] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.248] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd83600c0, ftCreationTime.dwHighDateTime=0x1d4ca71, ftLastAccessTime.dwLowDateTime=0x494be7f0, ftLastAccessTime.dwHighDateTime=0x1d4cdd0, ftLastWriteTime.dwLowDateTime=0x494be7f0, ftLastWriteTime.dwHighDateTime=0x1d4cdd0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.248] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.248] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.248] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e0de80, ftCreationTime.dwHighDateTime=0x1d4d297, ftLastAccessTime.dwLowDateTime=0x6be19140, ftLastAccessTime.dwHighDateTime=0x1d4d12f, ftLastWriteTime.dwLowDateTime=0x6be19140, ftLastWriteTime.dwHighDateTime=0x1d4d12f, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JgCxDEBm.m4a", cAlternateFileName="")) returned 1 [0050.248] lstrcmpiW (lpString1="JgCxDEBm.m4a", lpString2=".") returned 1 [0050.248] lstrcmpiW (lpString1="JgCxDEBm.m4a", lpString2="..") returned 1 [0050.248] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\", lpString2="JgCxDEBm.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a" [0050.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JgCxDEBm.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.248] GetProcessHeap () returned 0x560000 [0050.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0050.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JgCxDEBm.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JgCxDEBm.m4a", lpUsedDefaultChar=0x0) returned 13 [0050.248] lstrlenA (lpString="JgCxDEBm.m4a") returned 12 [0050.248] lstrlenA (lpString=".badday") returned 7 [0050.248] lstrlenA (lpString=".badday") returned 7 [0050.248] lstrlenA (lpString="JgCxDEBm.m4a") returned 12 [0050.248] lstrcmpiA (lpString1="EBm.m4a", lpString2=".badday") returned 1 [0050.248] lstrcmpiW (lpString1="JgCxDEBm.m4a", lpString2="how_to_back_files.html") returned 1 [0050.248] lstrcmpiW (lpString1="JgCxDEBm.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.248] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.248] lstrcmpiW (lpString1="JgCxDEBm.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.248] GetProcessHeap () returned 0x560000 [0050.248] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0050.248] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\jgcxdebm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.249] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=2245) returned 1 [0050.249] GetProcessHeap () returned 0x560000 [0050.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.249] GetProcessHeap () returned 0x560000 [0050.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0050.249] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a") returned 63 [0050.249] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.249] GetProcessHeap () returned 0x560000 [0050.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.249] GetProcessHeap () returned 0x560000 [0050.249] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x5a4a78 [0050.250] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.250] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1808) returned 1 [0050.250] CryptGenRandom (in: hProv=0x5a1808, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.250] CryptReleaseContext (hProv=0x5a1808, dwFlags=0x0) returned 1 [0050.250] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.250] GetProcessHeap () returned 0x560000 [0050.250] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1de0 [0050.251] lstrlenA (lpString="010001") returned 6 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0e20 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1050 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3588 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0050.251] GetProcessHeap () returned 0x560000 [0050.251] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3528 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5867b0 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3528 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.252] GetProcessHeap () returned 0x560000 [0050.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.253] GetProcessHeap () returned 0x560000 [0050.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.254] GetProcessHeap () returned 0x560000 [0050.254] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.255] GetProcessHeap () returned 0x560000 [0050.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.255] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3588 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0050.256] GetProcessHeap () returned 0x560000 [0050.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.257] GetProcessHeap () returned 0x560000 [0050.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0050.257] GetProcessHeap () returned 0x560000 [0050.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.257] GetProcessHeap () returned 0x560000 [0050.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.257] GetProcessHeap () returned 0x560000 [0050.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1de0 | out: hHeap=0x560000) returned 1 [0050.257] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a78*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4a78*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0050.258] GetProcessHeap () returned 0x560000 [0050.258] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4a78, Size=0x30) returned 0x5a4a78 [0050.258] GetProcessHeap () returned 0x560000 [0050.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.258] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.258] GetProcessHeap () returned 0x560000 [0050.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8d0) returned 0x5a4ab0 [0050.258] ReadFile (in: hFile=0x230, lpBuffer=0x5a4ab0, nNumberOfBytesToRead=0x8d0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4ab0*, lpNumberOfBytesRead=0x24ad7e8*=0x8d0, lpOverlapped=0x0) returned 1 [0050.258] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.259] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ab0*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4ab0*, lpNumberOfBytesWritten=0x24ad7e4*=0x8d0, lpOverlapped=0x0) returned 1 [0050.259] GetProcessHeap () returned 0x560000 [0050.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4ab0 | out: hHeap=0x560000) returned 1 [0050.259] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.260] WriteFile (in: hFile=0x230, lpBuffer=0x5a4a78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4a78*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.260] CloseHandle (hObject=0x230) returned 1 [0050.261] GetProcessHeap () returned 0x560000 [0050.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0050.261] GetProcessHeap () returned 0x560000 [0050.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.261] GetProcessHeap () returned 0x560000 [0050.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0050.261] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a" [0050.262] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a.badday" [0050.262] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\jgcxdebm.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\jgcxdebm.m4a.badday"), dwFlags=0x1) returned 1 [0050.263] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\JgCxDEBm.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy") returned 1 [0050.263] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned="" [0050.263] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html" [0050.263] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\how_to_back_files.html")) returned 0xffffffff [0050.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0050.264] GetProcessHeap () returned 0x560000 [0050.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.264] GetProcessHeap () returned 0x560000 [0050.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0050.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.283] GetProcessHeap () returned 0x560000 [0050.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.283] GetProcessHeap () returned 0x560000 [0050.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0050.283] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0050.283] GetProcessHeap () returned 0x560000 [0050.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.283] GetProcessHeap () returned 0x560000 [0050.283] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.292] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.293] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.294] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.328] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.331] GetProcessHeap () returned 0x560000 [0050.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.331] GetProcessHeap () returned 0x560000 [0050.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0050.331] CloseHandle (hObject=0x230) returned 1 [0050.331] GetProcessHeap () returned 0x560000 [0050.331] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.331] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8fae060, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x96e95190, ftLastAccessTime.dwHighDateTime=0x1d4d34e, ftLastWriteTime.dwLowDateTime=0x96e95190, ftLastWriteTime.dwHighDateTime=0x1d4d34e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v0MtQh", cAlternateFileName="")) returned 1 [0050.331] lstrcmpiW (lpString1="v0MtQh", lpString2=".") returned 1 [0050.331] lstrcmpiW (lpString1="v0MtQh", lpString2="..") returned 1 [0050.331] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\", lpString2="v0MtQh" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" [0050.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="v0MtQh", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.331] GetProcessHeap () returned 0x560000 [0050.332] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x58a168 [0050.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="v0MtQh", cchWideChar=-1, lpMultiByteStr=0x58a168, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="v0MtQh", lpUsedDefaultChar=0x0) returned 7 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0050.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0050.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="v0MtQh", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0050.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\" [0050.333] GetProcessHeap () returned 0x560000 [0050.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a138 [0050.333] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned 58 [0050.333] GetProcessHeap () returned 0x560000 [0050.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x76) returned 0x5a45a0 [0050.333] lstrcpyW (in: lpString1=0x5a45a0, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\" [0050.333] GetProcessHeap () returned 0x560000 [0050.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.333] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd05550, ftCreationTime.dwHighDateTime=0x1d4c99d, ftLastAccessTime.dwLowDateTime=0x750e9690, ftLastAccessTime.dwHighDateTime=0x1d4d54f, ftLastWriteTime.dwLowDateTime=0x750e9690, ftLastWriteTime.dwHighDateTime=0x1d4d54f, nFileSizeHigh=0x0, nFileSizeLow=0xdd20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WUmNdid8BFxHy.mp3", cAlternateFileName="WUMNDI~1.MP3")) returned 1 [0050.333] lstrcmpiW (lpString1="WUmNdid8BFxHy.mp3", lpString2=".") returned 1 [0050.333] lstrcmpiW (lpString1="WUmNdid8BFxHy.mp3", lpString2="..") returned 1 [0050.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\", lpString2="WUmNdid8BFxHy.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3" [0050.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WUmNdid8BFxHy.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0050.333] GetProcessHeap () returned 0x560000 [0050.333] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x5769f8 [0050.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WUmNdid8BFxHy.mp3", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WUmNdid8BFxHy.mp3", lpUsedDefaultChar=0x0) returned 18 [0050.334] lstrlenA (lpString="WUmNdid8BFxHy.mp3") returned 17 [0050.334] lstrlenA (lpString=".badday") returned 7 [0050.334] lstrlenA (lpString=".badday") returned 7 [0050.334] lstrlenA (lpString="WUmNdid8BFxHy.mp3") returned 17 [0050.334] lstrcmpiA (lpString1="xHy.mp3", lpString2=".badday") returned 1 [0050.334] lstrcmpiW (lpString1="WUmNdid8BFxHy.mp3", lpString2="how_to_back_files.html") returned 1 [0050.334] lstrcmpiW (lpString1="WUmNdid8BFxHy.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.334] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.334] lstrcmpiW (lpString1="WUmNdid8BFxHy.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.334] GetProcessHeap () returned 0x560000 [0050.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0050.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\wumndid8bfxhy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.334] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=56608) returned 1 [0050.334] GetProcessHeap () returned 0x560000 [0050.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.334] GetProcessHeap () returned 0x560000 [0050.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0050.334] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3") returned 68 [0050.334] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.334] GetProcessHeap () returned 0x560000 [0050.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.334] GetProcessHeap () returned 0x560000 [0050.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4ab0 [0050.334] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.334] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1f78) returned 1 [0050.335] CryptGenRandom (in: hProv=0x5a1f78, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.335] CryptReleaseContext (hProv=0x5a1f78, dwFlags=0x0) returned 1 [0050.335] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0050.335] lstrlenA (lpString="010001") returned 6 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0e20 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0050.335] GetProcessHeap () returned 0x560000 [0050.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1050 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a35e8 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f90 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a35e8 | out: hHeap=0x560000) returned 1 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0050.336] GetProcessHeap () returned 0x560000 [0050.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.337] GetProcessHeap () returned 0x560000 [0050.337] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.337] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.338] GetProcessHeap () returned 0x560000 [0050.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.338] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.339] GetProcessHeap () returned 0x560000 [0050.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.339] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.340] GetProcessHeap () returned 0x560000 [0050.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.340] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.341] GetProcessHeap () returned 0x560000 [0050.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0050.341] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ab0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ab0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.344] GetProcessHeap () returned 0x560000 [0050.344] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4ab0, Size=0x30) returned 0x5a4ab0 [0050.344] GetProcessHeap () returned 0x560000 [0050.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.344] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.344] GetProcessHeap () returned 0x560000 [0050.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xdd20) returned 0x5a4ae8 [0050.345] ReadFile (in: hFile=0x230, lpBuffer=0x5a4ae8, nNumberOfBytesToRead=0xdd20, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4ae8*, lpNumberOfBytesRead=0x24ad7e8*=0xdd20, lpOverlapped=0x0) returned 1 [0050.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.346] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ae8*, nNumberOfBytesToWrite=0xdd20, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4ae8*, lpNumberOfBytesWritten=0x24ad7e4*=0xdd20, lpOverlapped=0x0) returned 1 [0050.347] GetProcessHeap () returned 0x560000 [0050.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4ae8 | out: hHeap=0x560000) returned 1 [0050.348] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.348] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ab0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ab0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.349] CloseHandle (hObject=0x230) returned 1 [0050.351] GetProcessHeap () returned 0x560000 [0050.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0050.351] GetProcessHeap () returned 0x560000 [0050.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.351] GetProcessHeap () returned 0x560000 [0050.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0050.351] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3" [0050.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3.badday" [0050.352] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\wumndid8bfxhy.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\wumndid8bfxhy.mp3.badday"), dwFlags=0x1) returned 1 [0050.352] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\WUmNdid8BFxHy.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy") returned 1 [0050.352] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\") returned="" [0050.352] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html" [0050.352] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\how_to_back_files.html")) returned 0x20 [0050.352] GetProcessHeap () returned 0x560000 [0050.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0050.352] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd05550, ftCreationTime.dwHighDateTime=0x1d4c99d, ftLastAccessTime.dwLowDateTime=0x750e9690, ftLastAccessTime.dwHighDateTime=0x1d4d54f, ftLastWriteTime.dwLowDateTime=0x750e9690, ftLastWriteTime.dwHighDateTime=0x1d4d54f, nFileSizeHigh=0x0, nFileSizeLow=0xdd20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WUmNdid8BFxHy.mp3", cAlternateFileName="WUMNDI~1.MP3")) returned 0 [0050.352] FindClose (in: hFindFile=0x5797c8 | out: hFindFile=0x5797c8) returned 1 [0050.352] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\" [0050.352] GetProcessHeap () returned 0x560000 [0050.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a45a0 | out: hHeap=0x560000) returned 1 [0050.352] GetProcessHeap () returned 0x560000 [0050.353] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.353] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned 58 [0050.353] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\*" [0050.353] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8fae060, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x96e95190, ftLastAccessTime.dwHighDateTime=0x1d4d34e, ftLastWriteTime.dwLowDateTime=0x96e95190, ftLastWriteTime.dwHighDateTime=0x1d4d34e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0050.353] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.353] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8fae060, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x96e95190, ftLastAccessTime.dwHighDateTime=0x1d4d34e, ftLastWriteTime.dwLowDateTime=0x96e95190, ftLastWriteTime.dwHighDateTime=0x1d4d34e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.353] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.353] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.353] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afe870, ftCreationTime.dwHighDateTime=0x1d4d581, ftLastAccessTime.dwLowDateTime=0x294b8d30, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x294b8d30, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x169fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-Re6zKU.wav", cAlternateFileName="")) returned 1 [0050.353] lstrcmpiW (lpString1="-Re6zKU.wav", lpString2=".") returned 1 [0050.353] lstrcmpiW (lpString1="-Re6zKU.wav", lpString2="..") returned 1 [0050.353] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="-Re6zKU.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav" [0050.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-Re6zKU.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.353] GetProcessHeap () returned 0x560000 [0050.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0050.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-Re6zKU.wav", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-Re6zKU.wav", lpUsedDefaultChar=0x0) returned 12 [0050.353] lstrlenA (lpString="-Re6zKU.wav") returned 11 [0050.353] lstrlenA (lpString=".badday") returned 7 [0050.353] lstrlenA (lpString=".badday") returned 7 [0050.353] lstrlenA (lpString="-Re6zKU.wav") returned 11 [0050.353] lstrcmpiA (lpString1="zKU.wav", lpString2=".badday") returned 1 [0050.353] lstrcmpiW (lpString1="-Re6zKU.wav", lpString2="how_to_back_files.html") returned 1 [0050.353] lstrcmpiW (lpString1="-Re6zKU.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.353] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.353] lstrcmpiW (lpString1="-Re6zKU.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.353] GetProcessHeap () returned 0x560000 [0050.353] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0050.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\-re6zku.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.354] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=92668) returned 1 [0050.354] GetProcessHeap () returned 0x560000 [0050.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.354] GetProcessHeap () returned 0x560000 [0050.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1cd0 [0050.354] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav") returned 69 [0050.354] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.354] GetProcessHeap () returned 0x560000 [0050.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.354] GetProcessHeap () returned 0x560000 [0050.354] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4ae8 [0050.355] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.355] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1890) returned 1 [0050.355] CryptGenRandom (in: hProv=0x5a1890, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.355] CryptReleaseContext (hProv=0x5a1890, dwFlags=0x0) returned 1 [0050.355] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.355] GetProcessHeap () returned 0x560000 [0050.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0050.356] lstrlenA (lpString="010001") returned 6 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1168 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3690 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0050.356] GetProcessHeap () returned 0x560000 [0050.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0050.356] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3738 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587260 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3738 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.357] GetProcessHeap () returned 0x560000 [0050.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.357] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.358] GetProcessHeap () returned 0x560000 [0050.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.359] GetProcessHeap () returned 0x560000 [0050.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.360] GetProcessHeap () returned 0x560000 [0050.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.361] GetProcessHeap () returned 0x560000 [0050.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3690 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.362] GetProcessHeap () returned 0x560000 [0050.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0050.362] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ae8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ae8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.364] GetProcessHeap () returned 0x560000 [0050.364] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4ae8, Size=0x30) returned 0x5a4ae8 [0050.364] GetProcessHeap () returned 0x560000 [0050.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.364] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.364] GetProcessHeap () returned 0x560000 [0050.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x169fc) returned 0x5a4b20 [0050.369] ReadFile (in: hFile=0x230, lpBuffer=0x5a4b20, nNumberOfBytesToRead=0x169fc, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4b20*, lpNumberOfBytesRead=0x24ad7e8*=0x169fc, lpOverlapped=0x0) returned 1 [0050.370] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.370] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b20*, nNumberOfBytesToWrite=0x169fc, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4b20*, lpNumberOfBytesWritten=0x24ad7e4*=0x169fc, lpOverlapped=0x0) returned 1 [0050.372] GetProcessHeap () returned 0x560000 [0050.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4b20 | out: hHeap=0x560000) returned 1 [0050.372] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.372] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ae8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ae8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.373] CloseHandle (hObject=0x230) returned 1 [0050.378] GetProcessHeap () returned 0x560000 [0050.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0050.378] GetProcessHeap () returned 0x560000 [0050.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.378] GetProcessHeap () returned 0x560000 [0050.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1cd0 | out: hHeap=0x560000) returned 1 [0050.378] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav" [0050.378] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav.badday" [0050.378] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\-re6zku.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\-re6zku.wav.badday"), dwFlags=0x1) returned 1 [0050.379] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\-Re6zKU.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.379] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.379] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.379] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0xffffffff [0050.379] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0050.379] GetProcessHeap () returned 0x560000 [0050.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.379] GetProcessHeap () returned 0x560000 [0050.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1de0 [0050.385] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.386] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.386] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.386] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.386] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.386] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.397] GetProcessHeap () returned 0x560000 [0050.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.397] GetProcessHeap () returned 0x560000 [0050.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1de0 | out: hHeap=0x560000) returned 1 [0050.397] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0050.397] GetProcessHeap () returned 0x560000 [0050.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.397] GetProcessHeap () returned 0x560000 [0050.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.407] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.408] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.454] GetProcessHeap () returned 0x560000 [0050.454] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.454] GetProcessHeap () returned 0x560000 [0050.454] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0050.454] CloseHandle (hObject=0x230) returned 1 [0050.455] GetProcessHeap () returned 0x560000 [0050.455] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.455] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac00f0, ftCreationTime.dwHighDateTime=0x1d4c985, ftLastAccessTime.dwLowDateTime=0xd6bb8330, ftLastAccessTime.dwHighDateTime=0x1d4c857, ftLastWriteTime.dwLowDateTime=0xd6bb8330, ftLastWriteTime.dwHighDateTime=0x1d4c857, nFileSizeHigh=0x0, nFileSizeLow=0xede6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9di9x.wav", cAlternateFileName="")) returned 1 [0050.455] lstrcmpiW (lpString1="9di9x.wav", lpString2=".") returned 1 [0050.455] lstrcmpiW (lpString1="9di9x.wav", lpString2="..") returned 1 [0050.455] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="9di9x.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav" [0050.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9di9x.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.455] GetProcessHeap () returned 0x560000 [0050.455] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0050.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9di9x.wav", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9di9x.wav", lpUsedDefaultChar=0x0) returned 10 [0050.455] lstrlenA (lpString="9di9x.wav") returned 9 [0050.455] lstrlenA (lpString=".badday") returned 7 [0050.455] lstrlenA (lpString=".badday") returned 7 [0050.455] lstrlenA (lpString="9di9x.wav") returned 9 [0050.455] lstrcmpiA (lpString1="i9x.wav", lpString2=".badday") returned 1 [0050.455] lstrcmpiW (lpString1="9di9x.wav", lpString2="how_to_back_files.html") returned -1 [0050.455] lstrcmpiW (lpString1="9di9x.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.455] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.455] lstrcmpiW (lpString1="9di9x.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.455] GetProcessHeap () returned 0x560000 [0050.455] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0050.455] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\9di9x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.455] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=60902) returned 1 [0050.456] GetProcessHeap () returned 0x560000 [0050.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.456] GetProcessHeap () returned 0x560000 [0050.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0050.456] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav") returned 67 [0050.456] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.456] GetProcessHeap () returned 0x560000 [0050.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.456] GetProcessHeap () returned 0x560000 [0050.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4b20 [0050.456] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.456] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1ef0) returned 1 [0050.456] CryptGenRandom (in: hProv=0x5a1ef0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.456] CryptReleaseContext (hProv=0x5a1ef0, dwFlags=0x0) returned 1 [0050.456] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.456] GetProcessHeap () returned 0x560000 [0050.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0050.456] lstrlenA (lpString="010001") returned 6 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0678 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0bf0 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a35a0 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0050.457] GetProcessHeap () returned 0x560000 [0050.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0050.457] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a35b8 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586cc0 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a35b8 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.458] GetProcessHeap () returned 0x560000 [0050.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.459] GetProcessHeap () returned 0x560000 [0050.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.460] GetProcessHeap () returned 0x560000 [0050.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.461] GetProcessHeap () returned 0x560000 [0050.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.461] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a35a0 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.462] GetProcessHeap () returned 0x560000 [0050.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0050.462] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b20*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4b20*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.465] GetProcessHeap () returned 0x560000 [0050.465] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4b20, Size=0x30) returned 0x5a4b20 [0050.465] GetProcessHeap () returned 0x560000 [0050.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.465] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.465] GetProcessHeap () returned 0x560000 [0050.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xede6) returned 0x5a4b58 [0050.465] ReadFile (in: hFile=0x230, lpBuffer=0x5a4b58, nNumberOfBytesToRead=0xede6, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4b58*, lpNumberOfBytesRead=0x24ad7e8*=0xede6, lpOverlapped=0x0) returned 1 [0050.466] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.466] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b58*, nNumberOfBytesToWrite=0xede6, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4b58*, lpNumberOfBytesWritten=0x24ad7e4*=0xede6, lpOverlapped=0x0) returned 1 [0050.467] GetProcessHeap () returned 0x560000 [0050.467] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4b58 | out: hHeap=0x560000) returned 1 [0050.468] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.468] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4b20*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.469] CloseHandle (hObject=0x230) returned 1 [0050.471] GetProcessHeap () returned 0x560000 [0050.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0050.471] GetProcessHeap () returned 0x560000 [0050.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.471] GetProcessHeap () returned 0x560000 [0050.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0050.471] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav" [0050.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav.badday" [0050.472] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\9di9x.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\9di9x.wav.badday"), dwFlags=0x1) returned 1 [0050.472] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\9di9x.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.472] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.472] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0x20 [0050.472] GetProcessHeap () returned 0x560000 [0050.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.472] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2727b9f0, ftCreationTime.dwHighDateTime=0x1d4d218, ftLastAccessTime.dwLowDateTime=0x58de4c30, ftLastAccessTime.dwHighDateTime=0x1d4cf6f, ftLastWriteTime.dwLowDateTime=0x58de4c30, ftLastWriteTime.dwHighDateTime=0x1d4cf6f, nFileSizeHigh=0x0, nFileSizeLow=0x49f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BZjyy S6Je.wav", cAlternateFileName="BZJYYS~1.WAV")) returned 1 [0050.472] lstrcmpiW (lpString1="BZjyy S6Je.wav", lpString2=".") returned 1 [0050.472] lstrcmpiW (lpString1="BZjyy S6Je.wav", lpString2="..") returned 1 [0050.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="BZjyy S6Je.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav" [0050.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BZjyy S6Je.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0050.472] GetProcessHeap () returned 0x560000 [0050.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0050.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BZjyy S6Je.wav", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BZjyy S6Je.wav", lpUsedDefaultChar=0x0) returned 15 [0050.473] lstrlenA (lpString="BZjyy S6Je.wav") returned 14 [0050.473] lstrlenA (lpString=".badday") returned 7 [0050.473] lstrlenA (lpString=".badday") returned 7 [0050.473] lstrlenA (lpString="BZjyy S6Je.wav") returned 14 [0050.473] lstrcmpiA (lpString1="6Je.wav", lpString2=".badday") returned 1 [0050.473] lstrcmpiW (lpString1="BZjyy S6Je.wav", lpString2="how_to_back_files.html") returned -1 [0050.473] lstrcmpiW (lpString1="BZjyy S6Je.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.473] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.473] lstrcmpiW (lpString1="BZjyy S6Je.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.473] GetProcessHeap () returned 0x560000 [0050.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0050.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\bzjyy s6je.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.473] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=18935) returned 1 [0050.473] GetProcessHeap () returned 0x560000 [0050.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.473] GetProcessHeap () returned 0x560000 [0050.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.473] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav") returned 72 [0050.473] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.473] GetProcessHeap () returned 0x560000 [0050.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.473] GetProcessHeap () returned 0x560000 [0050.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x5a4b58 [0050.474] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.474] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1890) returned 1 [0050.475] CryptGenRandom (in: hProv=0x5a1890, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.475] CryptReleaseContext (hProv=0x5a1890, dwFlags=0x0) returned 1 [0050.475] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a14d8 [0050.475] lstrlenA (lpString="010001") returned 6 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0448 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.475] GetProcessHeap () returned 0x560000 [0050.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0050.475] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3660 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3570 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587530 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3570 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.476] GetProcessHeap () returned 0x560000 [0050.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.477] GetProcessHeap () returned 0x560000 [0050.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.477] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.478] GetProcessHeap () returned 0x560000 [0050.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.478] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.479] GetProcessHeap () returned 0x560000 [0050.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.479] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.480] GetProcessHeap () returned 0x560000 [0050.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.480] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3660 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.481] GetProcessHeap () returned 0x560000 [0050.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a14d8 | out: hHeap=0x560000) returned 1 [0050.481] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b58*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4b58*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0050.486] GetProcessHeap () returned 0x560000 [0050.486] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4b58, Size=0x30) returned 0x5a4b58 [0050.486] GetProcessHeap () returned 0x560000 [0050.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.486] GetProcessHeap () returned 0x560000 [0050.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4a00) returned 0x5a4b90 [0050.486] ReadFile (in: hFile=0x230, lpBuffer=0x5a4b90, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4b90*, lpNumberOfBytesRead=0x24ad7e8*=0x4a00, lpOverlapped=0x0) returned 1 [0050.487] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.487] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b90*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4b90*, lpNumberOfBytesWritten=0x24ad7e4*=0x4a00, lpOverlapped=0x0) returned 1 [0050.488] GetProcessHeap () returned 0x560000 [0050.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4b90 | out: hHeap=0x560000) returned 1 [0050.488] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.488] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4b58*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.489] CloseHandle (hObject=0x230) returned 1 [0050.490] GetProcessHeap () returned 0x560000 [0050.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0050.490] GetProcessHeap () returned 0x560000 [0050.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.490] GetProcessHeap () returned 0x560000 [0050.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.490] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav" [0050.490] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav.badday" [0050.490] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\bzjyy s6je.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\bzjyy s6je.wav.badday"), dwFlags=0x1) returned 1 [0050.491] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\BZjyy S6Je.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.491] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.491] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.491] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0x20 [0050.491] GetProcessHeap () returned 0x560000 [0050.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.491] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf1b910, ftCreationTime.dwHighDateTime=0x1d4cf17, ftLastAccessTime.dwLowDateTime=0x1bd73820, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0x1bd73820, ftLastWriteTime.dwHighDateTime=0x1d4d108, nFileSizeHigh=0x0, nFileSizeLow=0x2f2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D2BCRx0eUWpvmPQE.m4a", cAlternateFileName="D2BCRX~1.M4A")) returned 1 [0050.491] lstrcmpiW (lpString1="D2BCRx0eUWpvmPQE.m4a", lpString2=".") returned 1 [0050.491] lstrcmpiW (lpString1="D2BCRx0eUWpvmPQE.m4a", lpString2="..") returned 1 [0050.491] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="D2BCRx0eUWpvmPQE.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a" [0050.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2BCRx0eUWpvmPQE.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0050.491] GetProcessHeap () returned 0x560000 [0050.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576b78 [0050.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2BCRx0eUWpvmPQE.m4a", cchWideChar=-1, lpMultiByteStr=0x576b78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2BCRx0eUWpvmPQE.m4a", lpUsedDefaultChar=0x0) returned 21 [0050.491] lstrlenA (lpString="D2BCRx0eUWpvmPQE.m4a") returned 20 [0050.491] lstrlenA (lpString=".badday") returned 7 [0050.491] lstrlenA (lpString=".badday") returned 7 [0050.491] lstrlenA (lpString="D2BCRx0eUWpvmPQE.m4a") returned 20 [0050.491] lstrcmpiA (lpString1="PQE.m4a", lpString2=".badday") returned 1 [0050.491] lstrcmpiW (lpString1="D2BCRx0eUWpvmPQE.m4a", lpString2="how_to_back_files.html") returned -1 [0050.491] lstrcmpiW (lpString1="D2BCRx0eUWpvmPQE.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.491] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.491] lstrcmpiW (lpString1="D2BCRx0eUWpvmPQE.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.491] GetProcessHeap () returned 0x560000 [0050.491] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0050.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\d2bcrx0euwpvmpqe.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.492] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=12076) returned 1 [0050.492] GetProcessHeap () returned 0x560000 [0050.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.492] GetProcessHeap () returned 0x560000 [0050.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0050.492] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a") returned 78 [0050.492] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.492] GetProcessHeap () returned 0x560000 [0050.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.492] GetProcessHeap () returned 0x560000 [0050.492] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4b90 [0050.492] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.492] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1890) returned 1 [0050.492] CryptGenRandom (in: hProv=0x5a1890, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.493] CryptReleaseContext (hProv=0x5a1890, dwFlags=0x0) returned 1 [0050.493] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0050.493] lstrlenA (lpString="010001") returned 6 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0ad8 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.493] GetProcessHeap () returned 0x560000 [0050.493] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a34c8 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587380 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a34c8 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.494] GetProcessHeap () returned 0x560000 [0050.494] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.495] GetProcessHeap () returned 0x560000 [0050.495] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.496] GetProcessHeap () returned 0x560000 [0050.496] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.497] GetProcessHeap () returned 0x560000 [0050.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.497] GetProcessHeap () returned 0x560000 [0050.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0050.498] GetProcessHeap () returned 0x560000 [0050.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.499] GetProcessHeap () returned 0x560000 [0050.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0050.499] GetProcessHeap () returned 0x560000 [0050.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.499] GetProcessHeap () returned 0x560000 [0050.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0050.499] GetProcessHeap () returned 0x560000 [0050.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0050.499] GetProcessHeap () returned 0x560000 [0050.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.499] GetProcessHeap () returned 0x560000 [0050.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0050.499] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b90*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4b90*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.501] GetProcessHeap () returned 0x560000 [0050.501] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4b90, Size=0x30) returned 0x5a4b90 [0050.501] GetProcessHeap () returned 0x560000 [0050.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.501] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.501] GetProcessHeap () returned 0x560000 [0050.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2f2c) returned 0x5a4bc8 [0050.501] ReadFile (in: hFile=0x230, lpBuffer=0x5a4bc8, nNumberOfBytesToRead=0x2f2c, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4bc8*, lpNumberOfBytesRead=0x24ad7e8*=0x2f2c, lpOverlapped=0x0) returned 1 [0050.502] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.502] WriteFile (in: hFile=0x230, lpBuffer=0x5a4bc8*, nNumberOfBytesToWrite=0x2f2c, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4bc8*, lpNumberOfBytesWritten=0x24ad7e4*=0x2f2c, lpOverlapped=0x0) returned 1 [0050.503] GetProcessHeap () returned 0x560000 [0050.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4bc8 | out: hHeap=0x560000) returned 1 [0050.503] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.503] WriteFile (in: hFile=0x230, lpBuffer=0x5a4b90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4b90*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.503] CloseHandle (hObject=0x230) returned 1 [0050.505] GetProcessHeap () returned 0x560000 [0050.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0050.505] GetProcessHeap () returned 0x560000 [0050.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.505] GetProcessHeap () returned 0x560000 [0050.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0050.505] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a" [0050.505] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a.badday" [0050.505] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\d2bcrx0euwpvmpqe.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\d2bcrx0euwpvmpqe.m4a.badday"), dwFlags=0x1) returned 1 [0050.505] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\D2BCRx0eUWpvmPQE.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.505] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.506] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.506] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0x20 [0050.506] GetProcessHeap () returned 0x560000 [0050.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b78 | out: hHeap=0x560000) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa308b0, ftCreationTime.dwHighDateTime=0x1d4cd41, ftLastAccessTime.dwLowDateTime=0xc965b8d0, ftLastAccessTime.dwHighDateTime=0x1d4cd58, ftLastWriteTime.dwLowDateTime=0xc965b8d0, ftLastWriteTime.dwHighDateTime=0x1d4cd58, nFileSizeHigh=0x0, nFileSizeLow=0xaca0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JRnC0ugsmJw.m4a", cAlternateFileName="JRNC0U~1.M4A")) returned 1 [0050.506] lstrcmpiW (lpString1="JRnC0ugsmJw.m4a", lpString2=".") returned 1 [0050.506] lstrcmpiW (lpString1="JRnC0ugsmJw.m4a", lpString2="..") returned 1 [0050.506] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="JRnC0ugsmJw.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a" [0050.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JRnC0ugsmJw.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0050.506] GetProcessHeap () returned 0x560000 [0050.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0050.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JRnC0ugsmJw.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JRnC0ugsmJw.m4a", lpUsedDefaultChar=0x0) returned 16 [0050.506] lstrlenA (lpString="JRnC0ugsmJw.m4a") returned 15 [0050.506] lstrlenA (lpString=".badday") returned 7 [0050.506] lstrlenA (lpString=".badday") returned 7 [0050.506] lstrlenA (lpString="JRnC0ugsmJw.m4a") returned 15 [0050.506] lstrcmpiA (lpString1="mJw.m4a", lpString2=".badday") returned 1 [0050.506] lstrcmpiW (lpString1="JRnC0ugsmJw.m4a", lpString2="how_to_back_files.html") returned 1 [0050.506] lstrcmpiW (lpString1="JRnC0ugsmJw.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.506] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.506] lstrcmpiW (lpString1="JRnC0ugsmJw.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.506] GetProcessHeap () returned 0x560000 [0050.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0050.506] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\jrnc0ugsmjw.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.506] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=44192) returned 1 [0050.506] GetProcessHeap () returned 0x560000 [0050.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.507] GetProcessHeap () returned 0x560000 [0050.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0050.507] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a") returned 73 [0050.507] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.507] GetProcessHeap () returned 0x560000 [0050.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.507] GetProcessHeap () returned 0x560000 [0050.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4bc8 [0050.507] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.507] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1c48) returned 1 [0050.507] CryptGenRandom (in: hProv=0x5a1c48, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.507] CryptReleaseContext (hProv=0x5a1c48, dwFlags=0x0) returned 1 [0050.507] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.507] GetProcessHeap () returned 0x560000 [0050.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0050.507] lstrlenA (lpString="010001") returned 6 [0050.507] GetProcessHeap () returned 0x560000 [0050.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1280 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0ad8 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3540 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0050.508] GetProcessHeap () returned 0x560000 [0050.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.508] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3468 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5871d0 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3468 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.509] GetProcessHeap () returned 0x560000 [0050.509] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.510] GetProcessHeap () returned 0x560000 [0050.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.511] GetProcessHeap () returned 0x560000 [0050.511] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.512] GetProcessHeap () returned 0x560000 [0050.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3540 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0050.513] GetProcessHeap () returned 0x560000 [0050.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.514] GetProcessHeap () returned 0x560000 [0050.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.514] GetProcessHeap () returned 0x560000 [0050.514] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0050.514] WriteFile (in: hFile=0x230, lpBuffer=0x5a4bc8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4bc8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.516] GetProcessHeap () returned 0x560000 [0050.516] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4bc8, Size=0x30) returned 0x5a4bc8 [0050.516] GetProcessHeap () returned 0x560000 [0050.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.516] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.516] GetProcessHeap () returned 0x560000 [0050.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xaca0) returned 0x5a4c00 [0050.516] ReadFile (in: hFile=0x230, lpBuffer=0x5a4c00, nNumberOfBytesToRead=0xaca0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4c00*, lpNumberOfBytesRead=0x24ad7e8*=0xaca0, lpOverlapped=0x0) returned 1 [0050.517] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.517] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c00*, nNumberOfBytesToWrite=0xaca0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4c00*, lpNumberOfBytesWritten=0x24ad7e4*=0xaca0, lpOverlapped=0x0) returned 1 [0050.518] GetProcessHeap () returned 0x560000 [0050.518] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4c00 | out: hHeap=0x560000) returned 1 [0050.518] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.519] WriteFile (in: hFile=0x230, lpBuffer=0x5a4bc8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4bc8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.519] CloseHandle (hObject=0x230) returned 1 [0050.521] GetProcessHeap () returned 0x560000 [0050.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0050.521] GetProcessHeap () returned 0x560000 [0050.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.521] GetProcessHeap () returned 0x560000 [0050.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0050.521] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a" [0050.521] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a.badday" [0050.521] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\jrnc0ugsmjw.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\jrnc0ugsmjw.m4a.badday"), dwFlags=0x1) returned 1 [0050.522] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\JRnC0ugsmJw.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.522] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.522] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.522] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0x20 [0050.522] GetProcessHeap () returned 0x560000 [0050.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.522] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449f2240, ftCreationTime.dwHighDateTime=0x1d4d1c1, ftLastAccessTime.dwLowDateTime=0xe01b1a0, ftLastAccessTime.dwHighDateTime=0x1d4cf12, ftLastWriteTime.dwLowDateTime=0xe01b1a0, ftLastWriteTime.dwHighDateTime=0x1d4cf12, nFileSizeHigh=0x0, nFileSizeLow=0x3536, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KZeMHUSx.m4a", cAlternateFileName="")) returned 1 [0050.522] lstrcmpiW (lpString1="KZeMHUSx.m4a", lpString2=".") returned 1 [0050.522] lstrcmpiW (lpString1="KZeMHUSx.m4a", lpString2="..") returned 1 [0050.522] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="KZeMHUSx.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a" [0050.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="KZeMHUSx.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.522] GetProcessHeap () returned 0x560000 [0050.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0050.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="KZeMHUSx.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KZeMHUSx.m4a", lpUsedDefaultChar=0x0) returned 13 [0050.522] lstrlenA (lpString="KZeMHUSx.m4a") returned 12 [0050.522] lstrlenA (lpString=".badday") returned 7 [0050.522] lstrlenA (lpString=".badday") returned 7 [0050.522] lstrlenA (lpString="KZeMHUSx.m4a") returned 12 [0050.522] lstrcmpiA (lpString1="USx.m4a", lpString2=".badday") returned 1 [0050.522] lstrcmpiW (lpString1="KZeMHUSx.m4a", lpString2="how_to_back_files.html") returned 1 [0050.522] lstrcmpiW (lpString1="KZeMHUSx.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.522] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.523] lstrcmpiW (lpString1="KZeMHUSx.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.523] GetProcessHeap () returned 0x560000 [0050.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0050.523] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\kzemhusx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.523] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=13622) returned 1 [0050.523] GetProcessHeap () returned 0x560000 [0050.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.523] GetProcessHeap () returned 0x560000 [0050.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0050.523] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a") returned 70 [0050.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.523] GetProcessHeap () returned 0x560000 [0050.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.523] GetProcessHeap () returned 0x560000 [0050.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4c00 [0050.523] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.523] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1ef0) returned 1 [0050.524] CryptGenRandom (in: hProv=0x5a1ef0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.524] CryptReleaseContext (hProv=0x5a1ef0, dwFlags=0x0) returned 1 [0050.524] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0050.524] lstrlenA (lpString="010001") returned 6 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1050 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1168 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0790 [0050.524] GetProcessHeap () returned 0x560000 [0050.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3498 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a34c8 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5868d0 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a34c8 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.525] GetProcessHeap () returned 0x560000 [0050.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.526] GetProcessHeap () returned 0x560000 [0050.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.527] GetProcessHeap () returned 0x560000 [0050.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.527] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.528] GetProcessHeap () returned 0x560000 [0050.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.529] GetProcessHeap () returned 0x560000 [0050.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3498 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.530] GetProcessHeap () returned 0x560000 [0050.530] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0050.530] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c00*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4c00*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.544] GetProcessHeap () returned 0x560000 [0050.544] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4c00, Size=0x30) returned 0x5a4c00 [0050.544] GetProcessHeap () returned 0x560000 [0050.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.544] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.544] GetProcessHeap () returned 0x560000 [0050.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3536) returned 0x5a4c38 [0050.544] ReadFile (in: hFile=0x230, lpBuffer=0x5a4c38, nNumberOfBytesToRead=0x3536, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4c38*, lpNumberOfBytesRead=0x24ad7e8*=0x3536, lpOverlapped=0x0) returned 1 [0050.544] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.544] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c38*, nNumberOfBytesToWrite=0x3536, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4c38*, lpNumberOfBytesWritten=0x24ad7e4*=0x3536, lpOverlapped=0x0) returned 1 [0050.545] GetProcessHeap () returned 0x560000 [0050.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4c38 | out: hHeap=0x560000) returned 1 [0050.545] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.546] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4c00*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.546] CloseHandle (hObject=0x230) returned 1 [0050.548] GetProcessHeap () returned 0x560000 [0050.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0050.548] GetProcessHeap () returned 0x560000 [0050.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.548] GetProcessHeap () returned 0x560000 [0050.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0050.548] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a" [0050.548] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a.badday" [0050.548] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\kzemhusx.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\kzemhusx.m4a.badday"), dwFlags=0x1) returned 1 [0050.549] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\KZeMHUSx.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.549] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.549] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.549] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0x20 [0050.549] GetProcessHeap () returned 0x560000 [0050.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4574bdd0, ftCreationTime.dwHighDateTime=0x1d4d39a, ftLastAccessTime.dwLowDateTime=0x8f7143f0, ftLastAccessTime.dwHighDateTime=0x1d4d5ec, ftLastWriteTime.dwLowDateTime=0x8f7143f0, ftLastWriteTime.dwHighDateTime=0x1d4d5ec, nFileSizeHigh=0x0, nFileSizeLow=0xa627, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XO0m6otbWhGgXfzJAWw.mp3", cAlternateFileName="XO0M6O~1.MP3")) returned 1 [0050.549] lstrcmpiW (lpString1="XO0m6otbWhGgXfzJAWw.mp3", lpString2=".") returned 1 [0050.549] lstrcmpiW (lpString1="XO0m6otbWhGgXfzJAWw.mp3", lpString2="..") returned 1 [0050.549] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="XO0m6otbWhGgXfzJAWw.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3" [0050.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XO0m6otbWhGgXfzJAWw.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.549] GetProcessHeap () returned 0x560000 [0050.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5767f8 [0050.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XO0m6otbWhGgXfzJAWw.mp3", cchWideChar=-1, lpMultiByteStr=0x5767f8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XO0m6otbWhGgXfzJAWw.mp3", lpUsedDefaultChar=0x0) returned 24 [0050.549] lstrlenA (lpString="XO0m6otbWhGgXfzJAWw.mp3") returned 23 [0050.549] lstrlenA (lpString=".badday") returned 7 [0050.549] lstrlenA (lpString=".badday") returned 7 [0050.549] lstrlenA (lpString="XO0m6otbWhGgXfzJAWw.mp3") returned 23 [0050.549] lstrcmpiA (lpString1="AWw.mp3", lpString2=".badday") returned 1 [0050.549] lstrcmpiW (lpString1="XO0m6otbWhGgXfzJAWw.mp3", lpString2="how_to_back_files.html") returned 1 [0050.549] lstrcmpiW (lpString1="XO0m6otbWhGgXfzJAWw.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.549] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.549] lstrcmpiW (lpString1="XO0m6otbWhGgXfzJAWw.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.549] GetProcessHeap () returned 0x560000 [0050.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0050.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\xo0m6otbwhggxfzjaww.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.550] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=42535) returned 1 [0050.550] GetProcessHeap () returned 0x560000 [0050.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.550] GetProcessHeap () returned 0x560000 [0050.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.550] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3") returned 81 [0050.550] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.550] GetProcessHeap () returned 0x560000 [0050.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.550] GetProcessHeap () returned 0x560000 [0050.550] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4c38 [0050.550] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.550] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1780) returned 1 [0050.550] CryptGenRandom (in: hProv=0x5a1780, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.550] CryptReleaseContext (hProv=0x5a1780, dwFlags=0x0) returned 1 [0050.550] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0050.551] lstrlenA (lpString="010001") returned 6 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1050 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a09c0 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0ad8 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0050.551] GetProcessHeap () returned 0x560000 [0050.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a37e0 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586600 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a37e0 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.552] GetProcessHeap () returned 0x560000 [0050.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.553] GetProcessHeap () returned 0x560000 [0050.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.553] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.554] GetProcessHeap () returned 0x560000 [0050.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.554] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.555] GetProcessHeap () returned 0x560000 [0050.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a09c0 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.556] GetProcessHeap () returned 0x560000 [0050.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0050.557] GetProcessHeap () returned 0x560000 [0050.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.557] GetProcessHeap () returned 0x560000 [0050.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0050.557] GetProcessHeap () returned 0x560000 [0050.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.557] GetProcessHeap () returned 0x560000 [0050.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.557] GetProcessHeap () returned 0x560000 [0050.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0050.557] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c38*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4c38*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.558] GetProcessHeap () returned 0x560000 [0050.558] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4c38, Size=0x30) returned 0x5a4c38 [0050.558] GetProcessHeap () returned 0x560000 [0050.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.559] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.559] GetProcessHeap () returned 0x560000 [0050.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa627) returned 0x5a4c70 [0050.559] ReadFile (in: hFile=0x230, lpBuffer=0x5a4c70, nNumberOfBytesToRead=0xa627, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4c70*, lpNumberOfBytesRead=0x24ad7e8*=0xa627, lpOverlapped=0x0) returned 1 [0050.559] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.559] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c70*, nNumberOfBytesToWrite=0xa627, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4c70*, lpNumberOfBytesWritten=0x24ad7e4*=0xa627, lpOverlapped=0x0) returned 1 [0050.561] GetProcessHeap () returned 0x560000 [0050.561] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4c70 | out: hHeap=0x560000) returned 1 [0050.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.561] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4c38*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.561] CloseHandle (hObject=0x230) returned 1 [0050.564] GetProcessHeap () returned 0x560000 [0050.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0050.564] GetProcessHeap () returned 0x560000 [0050.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.564] GetProcessHeap () returned 0x560000 [0050.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.564] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3" [0050.564] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3.badday" [0050.564] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\xo0m6otbwhggxfzjaww.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\xo0m6otbwhggxfzjaww.mp3.badday"), dwFlags=0x1) returned 1 [0050.565] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\XO0m6otbWhGgXfzJAWw.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh") returned 1 [0050.565] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\") returned="" [0050.565] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" [0050.565] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0kp4qjpzjBRulygy\\v0MtQh\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0kp4qjpzjbrulygy\\v0mtqh\\how_to_back_files.html")) returned 0x20 [0050.565] GetProcessHeap () returned 0x560000 [0050.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5767f8 | out: hHeap=0x560000) returned 1 [0050.565] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4574bdd0, ftCreationTime.dwHighDateTime=0x1d4d39a, ftLastAccessTime.dwLowDateTime=0x8f7143f0, ftLastAccessTime.dwHighDateTime=0x1d4d5ec, ftLastWriteTime.dwLowDateTime=0x8f7143f0, ftLastWriteTime.dwHighDateTime=0x1d4d5ec, nFileSizeHigh=0x0, nFileSizeLow=0xa627, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XO0m6otbWhGgXfzJAWw.mp3", cAlternateFileName="XO0M6O~1.MP3")) returned 0 [0050.565] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0050.565] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\" [0050.565] GetProcessHeap () returned 0x560000 [0050.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0050.565] GetProcessHeap () returned 0x560000 [0050.565] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.565] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned 47 [0050.565] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\*" [0050.565] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976aa950, ftCreationTime.dwHighDateTime=0x1d4cab8, ftLastAccessTime.dwLowDateTime=0x9b1762b0, ftLastAccessTime.dwHighDateTime=0x1d4c74c, ftLastWriteTime.dwLowDateTime=0x9b1762b0, ftLastWriteTime.dwHighDateTime=0x1d4c74c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0050.565] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.565] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976aa950, ftCreationTime.dwHighDateTime=0x1d4cab8, ftLastAccessTime.dwLowDateTime=0x9b1762b0, ftLastAccessTime.dwHighDateTime=0x1d4c74c, ftLastWriteTime.dwLowDateTime=0x9b1762b0, ftLastWriteTime.dwHighDateTime=0x1d4c74c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.566] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.566] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.566] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a4b760, ftCreationTime.dwHighDateTime=0x1d4ccf2, ftLastAccessTime.dwLowDateTime=0xd10a78e0, ftLastAccessTime.dwHighDateTime=0x1d4cbc4, ftLastWriteTime.dwLowDateTime=0xd10a78e0, ftLastWriteTime.dwHighDateTime=0x1d4cbc4, nFileSizeHigh=0x0, nFileSizeLow=0x162e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Ju_ia.mp3", cAlternateFileName="")) returned 1 [0050.566] lstrcmpiW (lpString1="5Ju_ia.mp3", lpString2=".") returned 1 [0050.566] lstrcmpiW (lpString1="5Ju_ia.mp3", lpString2="..") returned 1 [0050.566] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="5Ju_ia.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3" [0050.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5Ju_ia.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.566] GetProcessHeap () returned 0x560000 [0050.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0050.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5Ju_ia.mp3", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5Ju_ia.mp3", lpUsedDefaultChar=0x0) returned 11 [0050.566] lstrlenA (lpString="5Ju_ia.mp3") returned 10 [0050.566] lstrlenA (lpString=".badday") returned 7 [0050.566] lstrlenA (lpString=".badday") returned 7 [0050.566] lstrlenA (lpString="5Ju_ia.mp3") returned 10 [0050.566] lstrcmpiA (lpString1="_ia.mp3", lpString2=".badday") returned 1 [0050.566] lstrcmpiW (lpString1="5Ju_ia.mp3", lpString2="how_to_back_files.html") returned -1 [0050.566] lstrcmpiW (lpString1="5Ju_ia.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0050.566] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.566] lstrcmpiW (lpString1="5Ju_ia.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.566] GetProcessHeap () returned 0x560000 [0050.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0050.566] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\5ju_ia.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.566] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=90849) returned 1 [0050.566] GetProcessHeap () returned 0x560000 [0050.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.566] GetProcessHeap () returned 0x560000 [0050.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0050.567] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3") returned 57 [0050.567] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.567] GetProcessHeap () returned 0x560000 [0050.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.567] GetProcessHeap () returned 0x560000 [0050.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4c70 [0050.567] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.567] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1808) returned 1 [0050.567] CryptGenRandom (in: hProv=0x5a1808, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.567] CryptReleaseContext (hProv=0x5a1808, dwFlags=0x0) returned 1 [0050.567] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.567] GetProcessHeap () returned 0x560000 [0050.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0050.567] lstrlenA (lpString="010001") returned 6 [0050.567] GetProcessHeap () returned 0x560000 [0050.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a08a8 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0ad8 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1168 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3750 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0050.568] GetProcessHeap () returned 0x560000 [0050.568] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0050.568] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3660 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586690 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3660 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586690 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.569] GetProcessHeap () returned 0x560000 [0050.569] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.569] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.570] GetProcessHeap () returned 0x560000 [0050.570] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.571] GetProcessHeap () returned 0x560000 [0050.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.572] GetProcessHeap () returned 0x560000 [0050.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1168 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0050.573] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3750 | out: hHeap=0x560000) returned 1 [0050.574] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0050.574] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.574] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0050.574] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.574] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.574] GetProcessHeap () returned 0x560000 [0050.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0050.574] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c70*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4c70*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.577] GetProcessHeap () returned 0x560000 [0050.577] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4c70, Size=0x30) returned 0x5a4c70 [0050.577] GetProcessHeap () returned 0x560000 [0050.577] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.577] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.577] GetProcessHeap () returned 0x560000 [0050.577] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x162e1) returned 0x5a4ca8 [0050.578] ReadFile (in: hFile=0x230, lpBuffer=0x5a4ca8, nNumberOfBytesToRead=0x162e1, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4ca8*, lpNumberOfBytesRead=0x24ad7e8*=0x162e1, lpOverlapped=0x0) returned 1 [0050.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.579] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ca8*, nNumberOfBytesToWrite=0x162e1, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4ca8*, lpNumberOfBytesWritten=0x24ad7e4*=0x162e1, lpOverlapped=0x0) returned 1 [0050.581] GetProcessHeap () returned 0x560000 [0050.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4ca8 | out: hHeap=0x560000) returned 1 [0050.581] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.581] WriteFile (in: hFile=0x230, lpBuffer=0x5a4c70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4c70*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.582] CloseHandle (hObject=0x230) returned 1 [0050.584] GetProcessHeap () returned 0x560000 [0050.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0050.584] GetProcessHeap () returned 0x560000 [0050.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.584] GetProcessHeap () returned 0x560000 [0050.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0050.584] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3" [0050.585] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3.badday" [0050.585] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\5ju_ia.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\5ju_ia.mp3.badday"), dwFlags=0x1) returned 1 [0050.585] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\5Ju_ia.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed") returned 1 [0050.585] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned="" [0050.585] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" [0050.585] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\how_to_back_files.html")) returned 0xffffffff [0050.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0050.586] GetProcessHeap () returned 0x560000 [0050.586] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.586] GetProcessHeap () returned 0x560000 [0050.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0050.593] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.601] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.603] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.604] GetProcessHeap () returned 0x560000 [0050.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.604] GetProcessHeap () returned 0x560000 [0050.605] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0050.605] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0050.605] GetProcessHeap () returned 0x560000 [0050.605] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.605] GetProcessHeap () returned 0x560000 [0050.605] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0050.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.611] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.616] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.746] GetProcessHeap () returned 0x560000 [0050.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.746] GetProcessHeap () returned 0x560000 [0050.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0050.746] CloseHandle (hObject=0x230) returned 1 [0050.746] GetProcessHeap () returned 0x560000 [0050.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.746] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f16160, ftCreationTime.dwHighDateTime=0x1d4d1e5, ftLastAccessTime.dwLowDateTime=0x88e11eb0, ftLastAccessTime.dwHighDateTime=0x1d4d1ce, ftLastWriteTime.dwLowDateTime=0x88e11eb0, ftLastWriteTime.dwHighDateTime=0x1d4d1ce, nFileSizeHigh=0x0, nFileSizeLow=0xa7b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COSGhjpiH8tia.mp3", cAlternateFileName="COSGHJ~1.MP3")) returned 1 [0050.747] lstrcmpiW (lpString1="COSGhjpiH8tia.mp3", lpString2=".") returned 1 [0050.747] lstrcmpiW (lpString1="COSGhjpiH8tia.mp3", lpString2="..") returned 1 [0050.747] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="COSGhjpiH8tia.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3" [0050.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COSGhjpiH8tia.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0050.747] GetProcessHeap () returned 0x560000 [0050.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x5769f8 [0050.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COSGhjpiH8tia.mp3", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COSGhjpiH8tia.mp3", lpUsedDefaultChar=0x0) returned 18 [0050.747] lstrlenA (lpString="COSGhjpiH8tia.mp3") returned 17 [0050.747] lstrlenA (lpString=".badday") returned 7 [0050.747] lstrlenA (lpString=".badday") returned 7 [0050.747] lstrlenA (lpString="COSGhjpiH8tia.mp3") returned 17 [0050.747] lstrcmpiA (lpString1="tia.mp3", lpString2=".badday") returned 1 [0050.747] lstrcmpiW (lpString1="COSGhjpiH8tia.mp3", lpString2="how_to_back_files.html") returned -1 [0050.747] lstrcmpiW (lpString1="COSGhjpiH8tia.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.747] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.747] lstrcmpiW (lpString1="COSGhjpiH8tia.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.747] GetProcessHeap () returned 0x560000 [0050.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0050.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\cosghjpih8tia.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.747] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=42937) returned 1 [0050.747] GetProcessHeap () returned 0x560000 [0050.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.748] GetProcessHeap () returned 0x560000 [0050.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.748] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3") returned 64 [0050.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.748] GetProcessHeap () returned 0x560000 [0050.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.748] GetProcessHeap () returned 0x560000 [0050.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4ca8 [0050.748] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.748] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1890) returned 1 [0050.748] CryptGenRandom (in: hProv=0x5a1890, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.748] CryptReleaseContext (hProv=0x5a1890, dwFlags=0x0) returned 1 [0050.748] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.748] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0050.749] lstrlenA (lpString="010001") returned 6 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0ad8 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0d08 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0050.749] GetProcessHeap () returned 0x560000 [0050.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a37c8 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586840 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a37c8 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1280 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.750] GetProcessHeap () returned 0x560000 [0050.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.750] GetProcessHeap () returned 0x560000 [0050.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.751] GetProcessHeap () returned 0x560000 [0050.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.751] GetProcessHeap () returned 0x560000 [0050.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.751] GetProcessHeap () returned 0x560000 [0050.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.751] GetProcessHeap () returned 0x560000 [0050.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.751] GetProcessHeap () returned 0x560000 [0050.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.751] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.752] GetProcessHeap () returned 0x560000 [0050.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.752] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.753] GetProcessHeap () returned 0x560000 [0050.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.753] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.754] GetProcessHeap () returned 0x560000 [0050.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1280 | out: hHeap=0x560000) returned 1 [0050.755] GetProcessHeap () returned 0x560000 [0050.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.756] GetProcessHeap () returned 0x560000 [0050.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0050.756] GetProcessHeap () returned 0x560000 [0050.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.756] GetProcessHeap () returned 0x560000 [0050.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0050.756] GetProcessHeap () returned 0x560000 [0050.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0050.756] GetProcessHeap () returned 0x560000 [0050.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.756] GetProcessHeap () returned 0x560000 [0050.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0050.756] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ca8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ca8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.758] GetProcessHeap () returned 0x560000 [0050.758] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4ca8, Size=0x30) returned 0x5a4ca8 [0050.758] GetProcessHeap () returned 0x560000 [0050.758] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.758] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.758] GetProcessHeap () returned 0x560000 [0050.758] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa7b9) returned 0x5a4ce0 [0050.758] ReadFile (in: hFile=0x230, lpBuffer=0x5a4ce0, nNumberOfBytesToRead=0xa7b9, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4ce0*, lpNumberOfBytesRead=0x24ad7e8*=0xa7b9, lpOverlapped=0x0) returned 1 [0050.759] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.759] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ce0*, nNumberOfBytesToWrite=0xa7b9, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4ce0*, lpNumberOfBytesWritten=0x24ad7e4*=0xa7b9, lpOverlapped=0x0) returned 1 [0050.760] GetProcessHeap () returned 0x560000 [0050.760] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4ce0 | out: hHeap=0x560000) returned 1 [0050.761] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.761] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ca8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.762] CloseHandle (hObject=0x230) returned 1 [0050.764] GetProcessHeap () returned 0x560000 [0050.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0050.764] GetProcessHeap () returned 0x560000 [0050.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.764] GetProcessHeap () returned 0x560000 [0050.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.764] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3" [0050.764] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3.badday" [0050.765] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\cosghjpih8tia.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\cosghjpih8tia.mp3.badday"), dwFlags=0x1) returned 1 [0050.765] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\COSGhjpiH8tia.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed") returned 1 [0050.765] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned="" [0050.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" [0050.765] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\how_to_back_files.html")) returned 0x20 [0050.765] GetProcessHeap () returned 0x560000 [0050.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0050.765] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a2e350, ftCreationTime.dwHighDateTime=0x1d4cd93, ftLastAccessTime.dwLowDateTime=0x9a35e420, ftLastAccessTime.dwHighDateTime=0x1d4d304, ftLastWriteTime.dwLowDateTime=0x9a35e420, ftLastWriteTime.dwHighDateTime=0x1d4d304, nFileSizeHigh=0x0, nFileSizeLow=0x170bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gywg7QEVcX.mp3", cAlternateFileName="GYWG7Q~1.MP3")) returned 1 [0050.765] lstrcmpiW (lpString1="gywg7QEVcX.mp3", lpString2=".") returned 1 [0050.765] lstrcmpiW (lpString1="gywg7QEVcX.mp3", lpString2="..") returned 1 [0050.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="gywg7QEVcX.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3" [0050.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gywg7QEVcX.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0050.766] GetProcessHeap () returned 0x560000 [0050.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0050.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gywg7QEVcX.mp3", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gywg7QEVcX.mp3", lpUsedDefaultChar=0x0) returned 15 [0050.766] lstrlenA (lpString="gywg7QEVcX.mp3") returned 14 [0050.766] lstrlenA (lpString=".badday") returned 7 [0050.766] lstrlenA (lpString=".badday") returned 7 [0050.766] lstrlenA (lpString="gywg7QEVcX.mp3") returned 14 [0050.766] lstrcmpiA (lpString1="VcX.mp3", lpString2=".badday") returned 1 [0050.766] lstrcmpiW (lpString1="gywg7QEVcX.mp3", lpString2="how_to_back_files.html") returned -1 [0050.766] lstrcmpiW (lpString1="gywg7QEVcX.mp3", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.766] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.766] lstrcmpiW (lpString1="gywg7QEVcX.mp3", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.766] GetProcessHeap () returned 0x560000 [0050.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0050.766] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\gywg7qevcx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.766] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=94396) returned 1 [0050.766] GetProcessHeap () returned 0x560000 [0050.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.766] GetProcessHeap () returned 0x560000 [0050.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0050.766] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3") returned 61 [0050.766] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.766] GetProcessHeap () returned 0x560000 [0050.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.767] GetProcessHeap () returned 0x560000 [0050.767] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4ce0 [0050.768] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.768] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1918) returned 1 [0050.768] CryptGenRandom (in: hProv=0x5a1918, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.768] CryptReleaseContext (hProv=0x5a1918, dwFlags=0x0) returned 1 [0050.768] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.768] GetProcessHeap () returned 0x560000 [0050.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0050.768] lstrlenA (lpString="010001") returned 6 [0050.768] GetProcessHeap () returned 0x560000 [0050.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2000 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2000 | out: hHeap=0x560000) returned 1 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0e20 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0bf0 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0790 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3810 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0050.769] GetProcessHeap () returned 0x560000 [0050.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0448 [0050.769] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a37e0 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587260 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a37e0 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a08a8 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.770] GetProcessHeap () returned 0x560000 [0050.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.770] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.771] GetProcessHeap () returned 0x560000 [0050.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.772] GetProcessHeap () returned 0x560000 [0050.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.773] GetProcessHeap () returned 0x560000 [0050.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.773] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.774] GetProcessHeap () returned 0x560000 [0050.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a08a8 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3810 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0bf0 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.775] GetProcessHeap () returned 0x560000 [0050.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0050.775] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ce0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ce0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0050.777] GetProcessHeap () returned 0x560000 [0050.777] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4ce0, Size=0x30) returned 0x5a4ce0 [0050.777] GetProcessHeap () returned 0x560000 [0050.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.777] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.777] GetProcessHeap () returned 0x560000 [0050.777] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x170bc) returned 0x5a4d18 [0050.779] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x170bc, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x170bc, lpOverlapped=0x0) returned 1 [0050.780] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.780] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x170bc, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x170bc, lpOverlapped=0x0) returned 1 [0050.786] GetProcessHeap () returned 0x560000 [0050.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0050.786] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.786] WriteFile (in: hFile=0x230, lpBuffer=0x5a4ce0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4ce0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.787] CloseHandle (hObject=0x230) returned 1 [0050.790] GetProcessHeap () returned 0x560000 [0050.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0050.790] GetProcessHeap () returned 0x560000 [0050.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.790] GetProcessHeap () returned 0x560000 [0050.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0050.790] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3" [0050.790] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3.badday" [0050.790] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\gywg7qevcx.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\gywg7qevcx.mp3.badday"), dwFlags=0x1) returned 1 [0050.791] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\gywg7QEVcX.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed") returned 1 [0050.791] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\") returned="" [0050.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" [0050.791] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\how_to_back_files.html")) returned 0x20 [0050.791] GetProcessHeap () returned 0x560000 [0050.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.791] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c63a9d0, ftCreationTime.dwHighDateTime=0x1d4d5ad, ftLastAccessTime.dwLowDateTime=0x6de58d50, ftLastAccessTime.dwHighDateTime=0x1d4cbfa, ftLastWriteTime.dwLowDateTime=0x6de58d50, ftLastWriteTime.dwHighDateTime=0x1d4cbfa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UgNFA9D3VjM", cAlternateFileName="UGNFA9~1")) returned 1 [0050.791] lstrcmpiW (lpString1="UgNFA9D3VjM", lpString2=".") returned 1 [0050.791] lstrcmpiW (lpString1="UgNFA9D3VjM", lpString2="..") returned 1 [0050.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\", lpString2="UgNFA9D3VjM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM" [0050.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="UgNFA9D3VjM", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.791] GetProcessHeap () returned 0x560000 [0050.791] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0050.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="UgNFA9D3VjM", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UgNFA9D3VjM", lpUsedDefaultChar=0x0) returned 12 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0050.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0050.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0050.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0050.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="UgNFA9D3VjM", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0050.793] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\" [0050.793] GetProcessHeap () returned 0x560000 [0050.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1c8 [0050.793] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned 59 [0050.793] GetProcessHeap () returned 0x560000 [0050.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x78) returned 0x5a3da0 [0050.793] lstrcpyW (in: lpString1=0x5a3da0, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\" [0050.793] GetProcessHeap () returned 0x560000 [0050.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.793] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c63a9d0, ftCreationTime.dwHighDateTime=0x1d4d5ad, ftLastAccessTime.dwLowDateTime=0x6de58d50, ftLastAccessTime.dwHighDateTime=0x1d4cbfa, ftLastWriteTime.dwLowDateTime=0x6de58d50, ftLastWriteTime.dwHighDateTime=0x1d4cbfa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UgNFA9D3VjM", cAlternateFileName="UGNFA9~1")) returned 0 [0050.793] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0050.793] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\" [0050.793] GetProcessHeap () returned 0x560000 [0050.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3da0 | out: hHeap=0x560000) returned 1 [0050.793] GetProcessHeap () returned 0x560000 [0050.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.793] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned 59 [0050.793] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\*" [0050.793] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c63a9d0, ftCreationTime.dwHighDateTime=0x1d4d5ad, ftLastAccessTime.dwLowDateTime=0x6de58d50, ftLastAccessTime.dwHighDateTime=0x1d4cbfa, ftLastWriteTime.dwLowDateTime=0x6de58d50, ftLastWriteTime.dwHighDateTime=0x1d4cbfa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579808 [0050.793] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.793] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c63a9d0, ftCreationTime.dwHighDateTime=0x1d4d5ad, ftLastAccessTime.dwLowDateTime=0x6de58d50, ftLastAccessTime.dwHighDateTime=0x1d4cbfa, ftLastWriteTime.dwLowDateTime=0x6de58d50, ftLastWriteTime.dwHighDateTime=0x1d4cbfa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.793] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.793] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.794] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f15970, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0x14bc9ac0, ftLastAccessTime.dwHighDateTime=0x1d4ce2a, ftLastWriteTime.dwLowDateTime=0x14bc9ac0, ftLastWriteTime.dwHighDateTime=0x1d4ce2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3ktLI17BS", cAlternateFileName="3KTLI1~1")) returned 1 [0050.794] lstrcmpiW (lpString1="3ktLI17BS", lpString2=".") returned 1 [0050.794] lstrcmpiW (lpString1="3ktLI17BS", lpString2="..") returned 1 [0050.794] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="3ktLI17BS" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS" [0050.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3ktLI17BS", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.794] GetProcessHeap () returned 0x560000 [0050.794] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0050.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3ktLI17BS", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ktLI17BS", lpUsedDefaultChar=0x0) returned 10 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0050.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0050.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="3ktLI17BS", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0050.795] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\" [0050.795] GetProcessHeap () returned 0x560000 [0050.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a198 [0050.795] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned 69 [0050.795] GetProcessHeap () returned 0x560000 [0050.795] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8c) returned 0x572708 [0050.795] lstrcpyW (in: lpString1=0x572708, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\" [0050.795] GetProcessHeap () returned 0x560000 [0050.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.795] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11847530, ftCreationTime.dwHighDateTime=0x1d4c70e, ftLastAccessTime.dwLowDateTime=0x1bc10b70, ftLastAccessTime.dwHighDateTime=0x1d4d1e1, ftLastWriteTime.dwLowDateTime=0x1bc10b70, ftLastWriteTime.dwHighDateTime=0x1d4d1e1, nFileSizeHigh=0x0, nFileSizeLow=0x118e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4zwf1aEWTn3ZAYls.wav", cAlternateFileName="4ZWF1A~1.WAV")) returned 1 [0050.796] lstrcmpiW (lpString1="4zwf1aEWTn3ZAYls.wav", lpString2=".") returned 1 [0050.796] lstrcmpiW (lpString1="4zwf1aEWTn3ZAYls.wav", lpString2="..") returned 1 [0050.796] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="4zwf1aEWTn3ZAYls.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav" [0050.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4zwf1aEWTn3ZAYls.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0050.796] GetProcessHeap () returned 0x560000 [0050.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576b18 [0050.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4zwf1aEWTn3ZAYls.wav", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4zwf1aEWTn3ZAYls.wav", lpUsedDefaultChar=0x0) returned 21 [0050.796] lstrlenA (lpString="4zwf1aEWTn3ZAYls.wav") returned 20 [0050.796] lstrlenA (lpString=".badday") returned 7 [0050.796] lstrlenA (lpString=".badday") returned 7 [0050.796] lstrlenA (lpString="4zwf1aEWTn3ZAYls.wav") returned 20 [0050.796] lstrcmpiA (lpString1="Yls.wav", lpString2=".badday") returned 1 [0050.796] lstrcmpiW (lpString1="4zwf1aEWTn3ZAYls.wav", lpString2="how_to_back_files.html") returned -1 [0050.796] lstrcmpiW (lpString1="4zwf1aEWTn3ZAYls.wav", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0050.796] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.796] lstrcmpiW (lpString1="4zwf1aEWTn3ZAYls.wav", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.796] GetProcessHeap () returned 0x560000 [0050.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0050.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\4zwf1aewtn3zayls.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.796] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=71909) returned 1 [0050.796] GetProcessHeap () returned 0x560000 [0050.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.796] GetProcessHeap () returned 0x560000 [0050.796] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0050.796] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav") returned 79 [0050.796] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.796] GetProcessHeap () returned 0x560000 [0050.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.797] GetProcessHeap () returned 0x560000 [0050.797] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x5a3878 [0050.797] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.797] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1450) returned 1 [0050.797] CryptGenRandom (in: hProv=0x5a1450, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.797] CryptReleaseContext (hProv=0x5a1450, dwFlags=0x0) returned 1 [0050.797] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.800] GetProcessHeap () returned 0x560000 [0050.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0050.800] lstrlenA (lpString="010001") returned 6 [0050.800] GetProcessHeap () returned 0x560000 [0050.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0050.800] GetProcessHeap () returned 0x560000 [0050.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0050.800] GetProcessHeap () returned 0x560000 [0050.800] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587410 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0ad8 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0e20 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0448 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0678 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.801] GetProcessHeap () returned 0x560000 [0050.801] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a35d0 [0050.801] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586de0 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a35d0 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0560 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.802] GetProcessHeap () returned 0x560000 [0050.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.802] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.803] GetProcessHeap () returned 0x560000 [0050.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.804] GetProcessHeap () returned 0x560000 [0050.804] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.805] GetProcessHeap () returned 0x560000 [0050.805] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.805] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0e20 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0678 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0560 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.806] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.806] GetProcessHeap () returned 0x560000 [0050.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0050.807] GetProcessHeap () returned 0x560000 [0050.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.807] GetProcessHeap () returned 0x560000 [0050.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587410 | out: hHeap=0x560000) returned 1 [0050.807] GetProcessHeap () returned 0x560000 [0050.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.807] GetProcessHeap () returned 0x560000 [0050.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.807] GetProcessHeap () returned 0x560000 [0050.807] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0050.807] WriteFile (in: hFile=0x230, lpBuffer=0x5a3878*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3878*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0050.809] GetProcessHeap () returned 0x560000 [0050.809] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3878, Size=0x30) returned 0x5a3878 [0050.809] GetProcessHeap () returned 0x560000 [0050.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.809] GetProcessHeap () returned 0x560000 [0050.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x118f0) returned 0x5a4d18 [0050.810] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x118f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x118f0, lpOverlapped=0x0) returned 1 [0050.811] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.811] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x118f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x118f0, lpOverlapped=0x0) returned 1 [0050.812] GetProcessHeap () returned 0x560000 [0050.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0050.812] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.812] WriteFile (in: hFile=0x230, lpBuffer=0x5a3878*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3878*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.820] CloseHandle (hObject=0x230) returned 1 [0050.822] GetProcessHeap () returned 0x560000 [0050.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0050.822] GetProcessHeap () returned 0x560000 [0050.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.822] GetProcessHeap () returned 0x560000 [0050.822] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0050.822] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav" [0050.822] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav.badday" [0050.822] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\4zwf1aewtn3zayls.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\4zwf1aewtn3zayls.wav.badday"), dwFlags=0x1) returned 1 [0050.823] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\4zwf1aEWTn3ZAYls.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM") returned 1 [0050.823] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned="" [0050.823] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" [0050.823] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\how_to_back_files.html")) returned 0xffffffff [0050.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0050.823] GetProcessHeap () returned 0x560000 [0050.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.823] GetProcessHeap () returned 0x560000 [0050.823] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.830] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.831] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.832] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.834] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.835] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.836] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.837] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.841] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.842] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.843] GetProcessHeap () returned 0x560000 [0050.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.843] GetProcessHeap () returned 0x560000 [0050.843] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.843] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0050.843] GetProcessHeap () returned 0x560000 [0050.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.843] GetProcessHeap () returned 0x560000 [0050.843] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0050.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.850] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.853] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.855] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.856] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.857] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0050.939] GetProcessHeap () returned 0x560000 [0050.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.939] GetProcessHeap () returned 0x560000 [0050.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0050.939] CloseHandle (hObject=0x230) returned 1 [0050.939] GetProcessHeap () returned 0x560000 [0050.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b18 | out: hHeap=0x560000) returned 1 [0050.939] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd85b9d0, ftCreationTime.dwHighDateTime=0x1d4c916, ftLastAccessTime.dwLowDateTime=0x15f19a90, ftLastAccessTime.dwHighDateTime=0x1d4d4c8, ftLastWriteTime.dwLowDateTime=0x15f19a90, ftLastWriteTime.dwHighDateTime=0x1d4d4c8, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cXbSoGgh8Nm_VYbbE6.m4a", cAlternateFileName="CXBSOG~1.M4A")) returned 1 [0050.939] lstrcmpiW (lpString1="cXbSoGgh8Nm_VYbbE6.m4a", lpString2=".") returned 1 [0050.939] lstrcmpiW (lpString1="cXbSoGgh8Nm_VYbbE6.m4a", lpString2="..") returned 1 [0050.940] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="cXbSoGgh8Nm_VYbbE6.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a" [0050.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cXbSoGgh8Nm_VYbbE6.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0050.940] GetProcessHeap () returned 0x560000 [0050.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x5768b8 [0050.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cXbSoGgh8Nm_VYbbE6.m4a", cchWideChar=-1, lpMultiByteStr=0x5768b8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cXbSoGgh8Nm_VYbbE6.m4a", lpUsedDefaultChar=0x0) returned 23 [0050.940] lstrlenA (lpString="cXbSoGgh8Nm_VYbbE6.m4a") returned 22 [0050.940] lstrlenA (lpString=".badday") returned 7 [0050.940] lstrlenA (lpString=".badday") returned 7 [0050.940] lstrlenA (lpString="cXbSoGgh8Nm_VYbbE6.m4a") returned 22 [0050.940] lstrcmpiA (lpString1="bE6.m4a", lpString2=".badday") returned 1 [0050.940] lstrcmpiW (lpString1="cXbSoGgh8Nm_VYbbE6.m4a", lpString2="how_to_back_files.html") returned -1 [0050.940] lstrcmpiW (lpString1="cXbSoGgh8Nm_VYbbE6.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.940] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.940] lstrcmpiW (lpString1="cXbSoGgh8Nm_VYbbE6.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.940] GetProcessHeap () returned 0x560000 [0050.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0050.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\cxbsoggh8nm_vybbe6.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.940] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=16793) returned 1 [0050.940] GetProcessHeap () returned 0x560000 [0050.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.940] GetProcessHeap () returned 0x560000 [0050.940] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0050.941] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a") returned 81 [0050.941] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.941] GetProcessHeap () returned 0x560000 [0050.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.941] GetProcessHeap () returned 0x560000 [0050.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x387) returned 0x5a38b0 [0050.941] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.941] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1de0) returned 1 [0050.941] CryptGenRandom (in: hProv=0x5a1de0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.941] CryptReleaseContext (hProv=0x5a1de0, dwFlags=0x0) returned 1 [0050.941] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.941] GetProcessHeap () returned 0x560000 [0050.941] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0050.942] lstrlenA (lpString="010001") returned 6 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586c30 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0ad8 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0790 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0d08 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0448 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0050.942] GetProcessHeap () returned 0x560000 [0050.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1050 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3810 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586ba0 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3810 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0f38 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.943] GetProcessHeap () returned 0x560000 [0050.943] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.944] GetProcessHeap () returned 0x560000 [0050.944] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.944] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.945] GetProcessHeap () returned 0x560000 [0050.945] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.946] GetProcessHeap () returned 0x560000 [0050.946] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0d08 | out: hHeap=0x560000) returned 1 [0050.947] GetProcessHeap () returned 0x560000 [0050.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1050 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0448 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0f38 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0ad8 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0790 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.948] GetProcessHeap () returned 0x560000 [0050.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0050.948] WriteFile (in: hFile=0x230, lpBuffer=0x5a38b0*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a38b0*, lpNumberOfBytesWritten=0x24ad864*=0x387, lpOverlapped=0x0) returned 1 [0050.950] GetProcessHeap () returned 0x560000 [0050.950] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a38b0, Size=0x30) returned 0x5a38b0 [0050.950] GetProcessHeap () returned 0x560000 [0050.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.950] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.951] GetProcessHeap () returned 0x560000 [0050.951] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x41a0) returned 0x5a4d18 [0050.951] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x41a0, lpOverlapped=0x0) returned 1 [0050.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.951] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x41a0, lpOverlapped=0x0) returned 1 [0050.952] GetProcessHeap () returned 0x560000 [0050.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0050.952] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.952] WriteFile (in: hFile=0x230, lpBuffer=0x5a38b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a38b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.953] CloseHandle (hObject=0x230) returned 1 [0050.957] GetProcessHeap () returned 0x560000 [0050.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0050.957] GetProcessHeap () returned 0x560000 [0050.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.957] GetProcessHeap () returned 0x560000 [0050.957] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0050.957] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a" [0050.957] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a.badday" [0050.957] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\cxbsoggh8nm_vybbe6.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\cxbsoggh8nm_vybbe6.m4a.badday"), dwFlags=0x1) returned 1 [0050.958] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\cXbSoGgh8Nm_VYbbE6.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM") returned 1 [0050.958] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned="" [0050.958] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" [0050.958] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\how_to_back_files.html")) returned 0x20 [0050.958] GetProcessHeap () returned 0x560000 [0050.958] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5768b8 | out: hHeap=0x560000) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23320100, ftCreationTime.dwHighDateTime=0x1d4cb0d, ftLastAccessTime.dwLowDateTime=0x40744420, ftLastAccessTime.dwHighDateTime=0x1d4d2fc, ftLastWriteTime.dwLowDateTime=0x40744420, ftLastWriteTime.dwHighDateTime=0x1d4d2fc, nFileSizeHigh=0x0, nFileSizeLow=0x4378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QHrXRscO9x65L5UAe--.m4a", cAlternateFileName="QHRXRS~1.M4A")) returned 1 [0050.958] lstrcmpiW (lpString1="QHrXRscO9x65L5UAe--.m4a", lpString2=".") returned 1 [0050.958] lstrcmpiW (lpString1="QHrXRscO9x65L5UAe--.m4a", lpString2="..") returned 1 [0050.958] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="QHrXRscO9x65L5UAe--.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a" [0050.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QHrXRscO9x65L5UAe--.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.958] GetProcessHeap () returned 0x560000 [0050.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5769f8 [0050.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QHrXRscO9x65L5UAe--.m4a", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QHrXRscO9x65L5UAe--.m4a", lpUsedDefaultChar=0x0) returned 24 [0050.958] lstrlenA (lpString="QHrXRscO9x65L5UAe--.m4a") returned 23 [0050.958] lstrlenA (lpString=".badday") returned 7 [0050.958] lstrlenA (lpString=".badday") returned 7 [0050.958] lstrlenA (lpString="QHrXRscO9x65L5UAe--.m4a") returned 23 [0050.958] lstrcmpiA (lpString1="e--.m4a", lpString2=".badday") returned 1 [0050.958] lstrcmpiW (lpString1="QHrXRscO9x65L5UAe--.m4a", lpString2="how_to_back_files.html") returned 1 [0050.958] lstrcmpiW (lpString1="QHrXRscO9x65L5UAe--.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.958] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.958] lstrcmpiW (lpString1="QHrXRscO9x65L5UAe--.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0050.958] GetProcessHeap () returned 0x560000 [0050.958] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0050.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\qhrxrsco9x65l5uae--.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.959] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=17272) returned 1 [0050.959] GetProcessHeap () returned 0x560000 [0050.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.959] GetProcessHeap () returned 0x560000 [0050.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0050.959] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a") returned 82 [0050.959] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.959] GetProcessHeap () returned 0x560000 [0050.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.959] GetProcessHeap () returned 0x560000 [0050.959] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x5a38e8 [0050.959] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.959] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1e68) returned 1 [0050.960] CryptGenRandom (in: hProv=0x5a1e68, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.960] CryptReleaseContext (hProv=0x5a1e68, dwFlags=0x0) returned 1 [0050.960] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a14d8 [0050.960] lstrlenA (lpString="010001") returned 6 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586720 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5848e0 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b10 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c28 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5847c8 [0050.960] GetProcessHeap () returned 0x560000 [0050.960] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5851a0 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3738 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5867b0 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3738 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584d40 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.961] GetProcessHeap () returned 0x560000 [0050.961] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.962] GetProcessHeap () returned 0x560000 [0050.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.962] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.963] GetProcessHeap () returned 0x560000 [0050.963] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.964] GetProcessHeap () returned 0x560000 [0050.964] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.965] GetProcessHeap () returned 0x560000 [0050.965] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c28 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586720 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.966] GetProcessHeap () returned 0x560000 [0050.966] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a14d8 | out: hHeap=0x560000) returned 1 [0050.966] WriteFile (in: hFile=0x230, lpBuffer=0x5a38e8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a38e8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0050.968] GetProcessHeap () returned 0x560000 [0050.968] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a38e8, Size=0x30) returned 0x5a38e8 [0050.968] GetProcessHeap () returned 0x560000 [0050.968] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.968] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.968] GetProcessHeap () returned 0x560000 [0050.968] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4380) returned 0x5a4d18 [0050.968] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x4380, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x4380, lpOverlapped=0x0) returned 1 [0050.969] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.969] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x4380, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x4380, lpOverlapped=0x0) returned 1 [0050.970] GetProcessHeap () returned 0x560000 [0050.970] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0050.970] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.970] WriteFile (in: hFile=0x230, lpBuffer=0x5a38e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a38e8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.971] CloseHandle (hObject=0x230) returned 1 [0050.972] GetProcessHeap () returned 0x560000 [0050.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0050.972] GetProcessHeap () returned 0x560000 [0050.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.972] GetProcessHeap () returned 0x560000 [0050.972] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0050.972] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a" [0050.972] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a.badday" [0050.972] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\qhrxrsco9x65l5uae--.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\qhrxrsco9x65l5uae--.m4a.badday"), dwFlags=0x1) returned 1 [0050.973] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\QHrXRscO9x65L5UAe--.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM") returned 1 [0050.973] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\") returned="" [0050.973] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" [0050.973] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\how_to_back_files.html")) returned 0x20 [0050.973] GetProcessHeap () returned 0x560000 [0050.973] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0050.973] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538a3020, ftCreationTime.dwHighDateTime=0x1d4d085, ftLastAccessTime.dwLowDateTime=0x7ae3a120, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0x7ae3a120, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yllHIAtlb", cAlternateFileName="YLLHIA~1")) returned 1 [0050.973] lstrcmpiW (lpString1="yllHIAtlb", lpString2=".") returned 1 [0050.973] lstrcmpiW (lpString1="yllHIAtlb", lpString2="..") returned 1 [0050.973] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\", lpString2="yllHIAtlb" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb" [0050.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yllHIAtlb", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.973] GetProcessHeap () returned 0x560000 [0050.973] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0050.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yllHIAtlb", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yllHIAtlb", lpUsedDefaultChar=0x0) returned 10 [0050.973] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0050.973] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0050.973] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0050.974] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0050.975] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="yllHIAtlb", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0050.975] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\" [0050.975] GetProcessHeap () returned 0x560000 [0050.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a1c8 [0050.975] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned 69 [0050.975] GetProcessHeap () returned 0x560000 [0050.975] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8c) returned 0x570aa8 [0050.975] lstrcpyW (in: lpString1=0x570aa8, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\" [0050.975] GetProcessHeap () returned 0x560000 [0050.975] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.975] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538a3020, ftCreationTime.dwHighDateTime=0x1d4d085, ftLastAccessTime.dwLowDateTime=0x7ae3a120, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0x7ae3a120, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yllHIAtlb", cAlternateFileName="YLLHIA~1")) returned 0 [0050.975] FindClose (in: hFindFile=0x579808 | out: hFindFile=0x579808) returned 1 [0050.975] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\" [0050.975] GetProcessHeap () returned 0x560000 [0050.975] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x570aa8 | out: hHeap=0x560000) returned 1 [0050.975] GetProcessHeap () returned 0x560000 [0050.975] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.975] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned 69 [0050.975] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\*" [0050.976] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538a3020, ftCreationTime.dwHighDateTime=0x1d4d085, ftLastAccessTime.dwLowDateTime=0x7ae3a120, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0x7ae3a120, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0050.976] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.976] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538a3020, ftCreationTime.dwHighDateTime=0x1d4d085, ftLastAccessTime.dwLowDateTime=0x7ae3a120, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0x7ae3a120, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.976] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.976] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.976] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf7094c0, ftCreationTime.dwHighDateTime=0x1d4cf1b, ftLastAccessTime.dwLowDateTime=0x26ae1570, ftLastAccessTime.dwHighDateTime=0x1d4d5ef, ftLastWriteTime.dwLowDateTime=0x26ae1570, ftLastWriteTime.dwHighDateTime=0x1d4d5ef, nFileSizeHigh=0x0, nFileSizeLow=0xcc9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cuyyYduckDveb81gD.m4a", cAlternateFileName="CUYYYD~1.M4A")) returned 1 [0050.976] lstrcmpiW (lpString1="cuyyYduckDveb81gD.m4a", lpString2=".") returned 1 [0050.976] lstrcmpiW (lpString1="cuyyYduckDveb81gD.m4a", lpString2="..") returned 1 [0050.976] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="cuyyYduckDveb81gD.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a" [0050.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cuyyYduckDveb81gD.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0050.976] GetProcessHeap () returned 0x560000 [0050.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576b58 [0050.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cuyyYduckDveb81gD.m4a", cchWideChar=-1, lpMultiByteStr=0x576b58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cuyyYduckDveb81gD.m4a", lpUsedDefaultChar=0x0) returned 22 [0050.976] lstrlenA (lpString="cuyyYduckDveb81gD.m4a") returned 21 [0050.976] lstrlenA (lpString=".badday") returned 7 [0050.976] lstrlenA (lpString=".badday") returned 7 [0050.976] lstrlenA (lpString="cuyyYduckDveb81gD.m4a") returned 21 [0050.976] lstrcmpiA (lpString1="1gD.m4a", lpString2=".badday") returned 1 [0050.976] lstrcmpiW (lpString1="cuyyYduckDveb81gD.m4a", lpString2="how_to_back_files.html") returned -1 [0050.976] lstrcmpiW (lpString1="cuyyYduckDveb81gD.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0050.976] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0050.976] lstrcmpiW (lpString1="cuyyYduckDveb81gD.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0050.976] GetProcessHeap () returned 0x560000 [0050.976] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0050.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\cuyyyduckdveb81gd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.977] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=52381) returned 1 [0050.977] GetProcessHeap () returned 0x560000 [0050.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.977] GetProcessHeap () returned 0x560000 [0050.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0050.977] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a") returned 90 [0050.977] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.977] GetProcessHeap () returned 0x560000 [0050.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0050.977] GetProcessHeap () returned 0x560000 [0050.977] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x5a3920 [0050.977] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.977] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1450) returned 1 [0050.978] CryptGenRandom (in: hProv=0x5a1450, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0050.978] CryptReleaseContext (hProv=0x5a1450, dwFlags=0x0) returned 1 [0050.978] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0050.978] lstrlenA (lpString="010001") returned 6 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1b38 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1b38 | out: hHeap=0x560000) returned 1 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586840 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584b10 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1c8 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5849f8 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584368 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584e58 [0050.978] GetProcessHeap () returned 0x560000 [0050.978] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3828 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586b10 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3828 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584f70 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.979] GetProcessHeap () returned 0x560000 [0050.979] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.979] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.980] GetProcessHeap () returned 0x560000 [0050.980] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.980] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0050.981] GetProcessHeap () returned 0x560000 [0050.981] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.982] GetProcessHeap () returned 0x560000 [0050.982] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0050.983] GetProcessHeap () returned 0x560000 [0050.983] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0050.983] GetProcessHeap () returned 0x560000 [0050.984] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586840 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849f8 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0050.984] GetProcessHeap () returned 0x560000 [0050.984] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0050.984] WriteFile (in: hFile=0x230, lpBuffer=0x5a3920*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3920*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0050.987] GetProcessHeap () returned 0x560000 [0050.987] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3920, Size=0x30) returned 0x5a3920 [0050.987] GetProcessHeap () returned 0x560000 [0050.987] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0050.987] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.987] GetProcessHeap () returned 0x560000 [0050.987] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xcca0) returned 0x5a4d18 [0050.987] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0xcca0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0xcca0, lpOverlapped=0x0) returned 1 [0050.988] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.988] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0xcca0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0xcca0, lpOverlapped=0x0) returned 1 [0050.989] GetProcessHeap () returned 0x560000 [0050.989] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0050.990] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0050.990] WriteFile (in: hFile=0x230, lpBuffer=0x5a3920*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3920*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0050.991] CloseHandle (hObject=0x230) returned 1 [0050.993] GetProcessHeap () returned 0x560000 [0050.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0050.993] GetProcessHeap () returned 0x560000 [0050.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0050.993] GetProcessHeap () returned 0x560000 [0050.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0050.993] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a" [0050.993] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a.badday" [0050.993] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\cuyyyduckdveb81gd.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\cuyyyduckdveb81gd.m4a.badday"), dwFlags=0x1) returned 1 [0050.994] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\cuyyYduckDveb81gD.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb") returned 1 [0050.994] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned="" [0050.994] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" [0050.994] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\how_to_back_files.html")) returned 0xffffffff [0050.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0050.994] GetProcessHeap () returned 0x560000 [0050.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0050.994] GetProcessHeap () returned 0x560000 [0050.994] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1d58 [0051.074] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.088] GetProcessHeap () returned 0x560000 [0051.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.088] GetProcessHeap () returned 0x560000 [0051.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d58 | out: hHeap=0x560000) returned 1 [0051.088] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.088] GetProcessHeap () returned 0x560000 [0051.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.089] GetProcessHeap () returned 0x560000 [0051.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0051.111] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.112] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.116] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.186] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.189] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.190] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.195] GetProcessHeap () returned 0x560000 [0051.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.195] GetProcessHeap () returned 0x560000 [0051.195] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0051.195] CloseHandle (hObject=0x230) returned 1 [0051.195] GetProcessHeap () returned 0x560000 [0051.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b58 | out: hHeap=0x560000) returned 1 [0051.196] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ada79f0, ftCreationTime.dwHighDateTime=0x1d4d182, ftLastAccessTime.dwLowDateTime=0xaabc8a0, ftLastAccessTime.dwHighDateTime=0x1d4d4e0, ftLastWriteTime.dwLowDateTime=0xaabc8a0, ftLastWriteTime.dwHighDateTime=0x1d4d4e0, nFileSizeHigh=0x0, nFileSizeLow=0x10a1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="l-ZtHyOn8AyY8ky6.m4a", cAlternateFileName="L-ZTHY~1.M4A")) returned 1 [0051.196] lstrcmpiW (lpString1="l-ZtHyOn8AyY8ky6.m4a", lpString2=".") returned 1 [0051.196] lstrcmpiW (lpString1="l-ZtHyOn8AyY8ky6.m4a", lpString2="..") returned 1 [0051.196] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="l-ZtHyOn8AyY8ky6.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a" [0051.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l-ZtHyOn8AyY8ky6.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.196] GetProcessHeap () returned 0x560000 [0051.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x5767f8 [0051.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l-ZtHyOn8AyY8ky6.m4a", cchWideChar=-1, lpMultiByteStr=0x5767f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l-ZtHyOn8AyY8ky6.m4a", lpUsedDefaultChar=0x0) returned 21 [0051.196] lstrlenA (lpString="l-ZtHyOn8AyY8ky6.m4a") returned 20 [0051.196] lstrlenA (lpString=".badday") returned 7 [0051.196] lstrlenA (lpString=".badday") returned 7 [0051.196] lstrlenA (lpString="l-ZtHyOn8AyY8ky6.m4a") returned 20 [0051.196] lstrcmpiA (lpString1="ky6.m4a", lpString2=".badday") returned 1 [0051.196] lstrcmpiW (lpString1="l-ZtHyOn8AyY8ky6.m4a", lpString2="how_to_back_files.html") returned 1 [0051.196] lstrcmpiW (lpString1="l-ZtHyOn8AyY8ky6.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.196] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.196] lstrcmpiW (lpString1="l-ZtHyOn8AyY8ky6.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0051.196] GetProcessHeap () returned 0x560000 [0051.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0051.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\l-zthyon8ayy8ky6.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.196] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=68127) returned 1 [0051.197] GetProcessHeap () returned 0x560000 [0051.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.197] GetProcessHeap () returned 0x560000 [0051.197] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.197] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a") returned 89 [0051.197] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.197] GetProcessHeap () returned 0x560000 [0051.199] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.200] GetProcessHeap () returned 0x560000 [0051.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x5a3958 [0051.200] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.200] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1450) returned 1 [0051.200] CryptGenRandom (in: hProv=0x5a1450, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.200] CryptReleaseContext (hProv=0x5a1450, dwFlags=0x0) returned 1 [0051.200] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.200] GetProcessHeap () returned 0x560000 [0051.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0051.200] lstrlenA (lpString="010001") returned 6 [0051.200] GetProcessHeap () returned 0x560000 [0051.200] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0051.200] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2000 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2000 | out: hHeap=0x560000) returned 1 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584b10 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5848e0 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584d40 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5847c8 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584f70 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0051.201] GetProcessHeap () returned 0x560000 [0051.201] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3510 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586960 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3510 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584598 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.202] GetProcessHeap () returned 0x560000 [0051.202] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.202] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.203] GetProcessHeap () returned 0x560000 [0051.203] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.203] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.204] GetProcessHeap () returned 0x560000 [0051.204] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.204] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.205] GetProcessHeap () returned 0x560000 [0051.205] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.206] GetProcessHeap () returned 0x560000 [0051.206] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.207] GetProcessHeap () returned 0x560000 [0051.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0051.207] GetProcessHeap () returned 0x560000 [0051.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.207] GetProcessHeap () returned 0x560000 [0051.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0051.207] GetProcessHeap () returned 0x560000 [0051.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.207] GetProcessHeap () returned 0x560000 [0051.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.207] GetProcessHeap () returned 0x560000 [0051.207] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0051.207] WriteFile (in: hFile=0x230, lpBuffer=0x5a3958*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3958*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0051.209] GetProcessHeap () returned 0x560000 [0051.209] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3958, Size=0x30) returned 0x5a3958 [0051.209] GetProcessHeap () returned 0x560000 [0051.209] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.209] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.209] GetProcessHeap () returned 0x560000 [0051.209] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10a20) returned 0x5a4d18 [0051.211] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x10a20, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x10a20, lpOverlapped=0x0) returned 1 [0051.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.212] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x10a20, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x10a20, lpOverlapped=0x0) returned 1 [0051.215] GetProcessHeap () returned 0x560000 [0051.215] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0051.215] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.215] WriteFile (in: hFile=0x230, lpBuffer=0x5a3958*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3958*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.216] CloseHandle (hObject=0x230) returned 1 [0051.218] GetProcessHeap () returned 0x560000 [0051.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0051.218] GetProcessHeap () returned 0x560000 [0051.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.218] GetProcessHeap () returned 0x560000 [0051.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.218] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a" [0051.218] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a.badday" [0051.218] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\l-zthyon8ayy8ky6.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\l-zthyon8ayy8ky6.m4a.badday"), dwFlags=0x1) returned 1 [0051.219] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\l-ZtHyOn8AyY8ky6.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb") returned 1 [0051.219] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned="" [0051.219] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" [0051.219] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\how_to_back_files.html")) returned 0x20 [0051.219] GetProcessHeap () returned 0x560000 [0051.219] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5767f8 | out: hHeap=0x560000) returned 1 [0051.219] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87e54820, ftCreationTime.dwHighDateTime=0x1d4cbb0, ftLastAccessTime.dwLowDateTime=0xa53683e0, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0xa53683e0, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x10245, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YBBU5UOJ.m4a", cAlternateFileName="")) returned 1 [0051.219] lstrcmpiW (lpString1="YBBU5UOJ.m4a", lpString2=".") returned 1 [0051.219] lstrcmpiW (lpString1="YBBU5UOJ.m4a", lpString2="..") returned 1 [0051.219] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="YBBU5UOJ.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a" [0051.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YBBU5UOJ.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.219] GetProcessHeap () returned 0x560000 [0051.219] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0051.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YBBU5UOJ.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YBBU5UOJ.m4a", lpUsedDefaultChar=0x0) returned 13 [0051.219] lstrlenA (lpString="YBBU5UOJ.m4a") returned 12 [0051.219] lstrlenA (lpString=".badday") returned 7 [0051.219] lstrlenA (lpString=".badday") returned 7 [0051.219] lstrlenA (lpString="YBBU5UOJ.m4a") returned 12 [0051.219] lstrcmpiA (lpString1="UOJ.m4a", lpString2=".badday") returned 1 [0051.219] lstrcmpiW (lpString1="YBBU5UOJ.m4a", lpString2="how_to_back_files.html") returned 1 [0051.220] lstrcmpiW (lpString1="YBBU5UOJ.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.220] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.220] lstrcmpiW (lpString1="YBBU5UOJ.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0051.220] GetProcessHeap () returned 0x560000 [0051.220] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0051.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\ybbu5uoj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.220] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=66117) returned 1 [0051.220] GetProcessHeap () returned 0x560000 [0051.220] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.220] GetProcessHeap () returned 0x560000 [0051.220] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0051.220] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a") returned 81 [0051.220] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.220] GetProcessHeap () returned 0x560000 [0051.220] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.220] GetProcessHeap () returned 0x560000 [0051.220] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x5a3990 [0051.220] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.220] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1ef0) returned 1 [0051.221] CryptGenRandom (in: hProv=0x5a1ef0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.221] CryptReleaseContext (hProv=0x5a1ef0, dwFlags=0x0) returned 1 [0051.221] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.221] lstrlenA (lpString="010001") returned 6 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1b38 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1b38 | out: hHeap=0x560000) returned 1 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584f70 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0051.221] GetProcessHeap () returned 0x560000 [0051.221] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x585088 [0051.221] GetProcessHeap () returned 0x560000 [0051.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584598 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5846b0 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a37e0 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5848e0 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3780 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586de0 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3780 | out: hHeap=0x560000) returned 1 [0051.222] GetProcessHeap () returned 0x560000 [0051.222] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b10 [0051.222] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.223] GetProcessHeap () returned 0x560000 [0051.223] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.224] GetProcessHeap () returned 0x560000 [0051.224] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.225] GetProcessHeap () returned 0x560000 [0051.225] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.226] GetProcessHeap () returned 0x560000 [0051.226] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.226] GetProcessHeap () returned 0x560000 [0051.227] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a37e0 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.227] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0051.227] GetProcessHeap () returned 0x560000 [0051.228] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0051.228] GetProcessHeap () returned 0x560000 [0051.228] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.228] GetProcessHeap () returned 0x560000 [0051.228] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.228] WriteFile (in: hFile=0x230, lpBuffer=0x5a3990*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3990*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0051.229] GetProcessHeap () returned 0x560000 [0051.229] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3990, Size=0x30) returned 0x5a3990 [0051.229] GetProcessHeap () returned 0x560000 [0051.229] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.229] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.229] GetProcessHeap () returned 0x560000 [0051.229] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10250) returned 0x5a4d18 [0051.229] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x10250, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x10250, lpOverlapped=0x0) returned 1 [0051.230] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.230] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x10250, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x10250, lpOverlapped=0x0) returned 1 [0051.232] GetProcessHeap () returned 0x560000 [0051.232] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0051.233] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.233] WriteFile (in: hFile=0x230, lpBuffer=0x5a3990*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3990*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.234] CloseHandle (hObject=0x230) returned 1 [0051.234] GetProcessHeap () returned 0x560000 [0051.234] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0051.234] GetProcessHeap () returned 0x560000 [0051.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.235] GetProcessHeap () returned 0x560000 [0051.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0051.235] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a" [0051.235] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a.badday" [0051.235] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\ybbu5uoj.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\ybbu5uoj.m4a.badday"), dwFlags=0x1) returned 1 [0051.235] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\YBBU5UOJ.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb") returned 1 [0051.235] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\") returned="" [0051.235] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" [0051.235] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\yllHIAtlb\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\yllhiatlb\\how_to_back_files.html")) returned 0x20 [0051.235] GetProcessHeap () returned 0x560000 [0051.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.236] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87e54820, ftCreationTime.dwHighDateTime=0x1d4cbb0, ftLastAccessTime.dwLowDateTime=0xa53683e0, ftLastAccessTime.dwHighDateTime=0x1d4cae2, ftLastWriteTime.dwLowDateTime=0xa53683e0, ftLastWriteTime.dwHighDateTime=0x1d4cae2, nFileSizeHigh=0x0, nFileSizeLow=0x10245, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YBBU5UOJ.m4a", cAlternateFileName="")) returned 0 [0051.236] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0051.236] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\" [0051.236] GetProcessHeap () returned 0x560000 [0051.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572708 | out: hHeap=0x560000) returned 1 [0051.236] GetProcessHeap () returned 0x560000 [0051.236] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.236] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned 69 [0051.236] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\*") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\*" [0051.236] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f15970, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0x14bc9ac0, ftLastAccessTime.dwHighDateTime=0x1d4ce2a, ftLastWriteTime.dwLowDateTime=0x14bc9ac0, ftLastWriteTime.dwHighDateTime=0x1d4ce2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0051.236] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.236] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f15970, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0x14bc9ac0, ftLastAccessTime.dwHighDateTime=0x1d4ce2a, ftLastWriteTime.dwLowDateTime=0x14bc9ac0, ftLastWriteTime.dwHighDateTime=0x1d4ce2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.236] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.236] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.236] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2177910, ftCreationTime.dwHighDateTime=0x1d4c8ff, ftLastAccessTime.dwLowDateTime=0x82b22860, ftLastAccessTime.dwHighDateTime=0x1d4cec5, ftLastWriteTime.dwLowDateTime=0x82b22860, ftLastWriteTime.dwHighDateTime=0x1d4cec5, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Drm6VWfsqlM.m4a", cAlternateFileName="DRM6VW~1.M4A")) returned 1 [0051.236] lstrcmpiW (lpString1="Drm6VWfsqlM.m4a", lpString2=".") returned 1 [0051.236] lstrcmpiW (lpString1="Drm6VWfsqlM.m4a", lpString2="..") returned 1 [0051.236] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="Drm6VWfsqlM.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a" [0051.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Drm6VWfsqlM.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.236] GetProcessHeap () returned 0x560000 [0051.236] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0051.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Drm6VWfsqlM.m4a", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Drm6VWfsqlM.m4a", lpUsedDefaultChar=0x0) returned 16 [0051.236] lstrlenA (lpString="Drm6VWfsqlM.m4a") returned 15 [0051.236] lstrlenA (lpString=".badday") returned 7 [0051.237] lstrlenA (lpString=".badday") returned 7 [0051.237] lstrlenA (lpString="Drm6VWfsqlM.m4a") returned 15 [0051.237] lstrcmpiA (lpString1="qlM.m4a", lpString2=".badday") returned 1 [0051.237] lstrcmpiW (lpString1="Drm6VWfsqlM.m4a", lpString2="how_to_back_files.html") returned -1 [0051.237] lstrcmpiW (lpString1="Drm6VWfsqlM.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.237] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.237] lstrcmpiW (lpString1="Drm6VWfsqlM.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.237] GetProcessHeap () returned 0x560000 [0051.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0051.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\drm6vwfsqlm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.237] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=20480) returned 1 [0051.237] GetProcessHeap () returned 0x560000 [0051.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.237] GetProcessHeap () returned 0x560000 [0051.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1c48 [0051.237] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a") returned 84 [0051.237] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.237] GetProcessHeap () returned 0x560000 [0051.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.237] GetProcessHeap () returned 0x560000 [0051.237] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a39c8 [0051.237] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.237] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2000) returned 1 [0051.238] CryptGenRandom (in: hProv=0x5a2000, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.238] CryptReleaseContext (hProv=0x5a2000, dwFlags=0x0) returned 1 [0051.238] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0051.238] lstrlenA (lpString="010001") returned 6 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0051.238] GetProcessHeap () returned 0x560000 [0051.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5851a0 [0051.238] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584f70 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x585088 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584368 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3678 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587020 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587020 | out: hHeap=0x560000) returned 1 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3498 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586b10 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3498 | out: hHeap=0x560000) returned 1 [0051.239] GetProcessHeap () returned 0x560000 [0051.239] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584480 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.240] GetProcessHeap () returned 0x560000 [0051.240] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.240] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.241] GetProcessHeap () returned 0x560000 [0051.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.242] GetProcessHeap () returned 0x560000 [0051.242] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.243] GetProcessHeap () returned 0x560000 [0051.243] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.243] GetProcessHeap () returned 0x560000 [0051.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.244] GetProcessHeap () returned 0x560000 [0051.244] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0051.244] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584480 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3678 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.245] GetProcessHeap () returned 0x560000 [0051.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0051.245] WriteFile (in: hFile=0x230, lpBuffer=0x5a39c8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a39c8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0051.252] GetProcessHeap () returned 0x560000 [0051.252] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a39c8, Size=0x30) returned 0x5a39c8 [0051.252] GetProcessHeap () returned 0x560000 [0051.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.252] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.252] GetProcessHeap () returned 0x560000 [0051.252] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5000) returned 0x5a4d18 [0051.253] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x5000, lpOverlapped=0x0) returned 1 [0051.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.253] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x5000, lpOverlapped=0x0) returned 1 [0051.255] GetProcessHeap () returned 0x560000 [0051.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0051.256] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.256] WriteFile (in: hFile=0x230, lpBuffer=0x5a39c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a39c8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.257] CloseHandle (hObject=0x230) returned 1 [0051.257] GetProcessHeap () returned 0x560000 [0051.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0051.257] GetProcessHeap () returned 0x560000 [0051.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.257] GetProcessHeap () returned 0x560000 [0051.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1c48 | out: hHeap=0x560000) returned 1 [0051.257] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a" [0051.257] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a.badday" [0051.257] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\drm6vwfsqlm.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\drm6vwfsqlm.m4a.badday"), dwFlags=0x1) returned 1 [0051.258] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\Drm6VWfsqlM.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS") returned 1 [0051.258] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned="" [0051.258] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" [0051.258] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\how_to_back_files.html")) returned 0xffffffff [0051.258] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.259] GetProcessHeap () returned 0x560000 [0051.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.259] GetProcessHeap () returned 0x560000 [0051.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.266] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.273] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.278] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.279] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.279] GetProcessHeap () returned 0x560000 [0051.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.279] GetProcessHeap () returned 0x560000 [0051.279] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.279] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.279] GetProcessHeap () returned 0x560000 [0051.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.279] GetProcessHeap () returned 0x560000 [0051.279] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.291] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.337] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.343] GetProcessHeap () returned 0x560000 [0051.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.343] GetProcessHeap () returned 0x560000 [0051.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0051.343] CloseHandle (hObject=0x230) returned 1 [0051.343] GetProcessHeap () returned 0x560000 [0051.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.343] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74210d60, ftCreationTime.dwHighDateTime=0x1d4d5bf, ftLastAccessTime.dwLowDateTime=0x350ffbd0, ftLastAccessTime.dwHighDateTime=0x1d4c99f, ftLastWriteTime.dwLowDateTime=0x350ffbd0, ftLastWriteTime.dwHighDateTime=0x1d4c99f, nFileSizeHigh=0x0, nFileSizeLow=0x116e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NqEQCVwFPSIorBW_.m4a", cAlternateFileName="NQEQCV~1.M4A")) returned 1 [0051.343] lstrcmpiW (lpString1="NqEQCVwFPSIorBW_.m4a", lpString2=".") returned 1 [0051.343] lstrcmpiW (lpString1="NqEQCVwFPSIorBW_.m4a", lpString2="..") returned 1 [0051.343] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="NqEQCVwFPSIorBW_.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a" [0051.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NqEQCVwFPSIorBW_.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.343] GetProcessHeap () returned 0x560000 [0051.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x5769f8 [0051.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NqEQCVwFPSIorBW_.m4a", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NqEQCVwFPSIorBW_.m4a", lpUsedDefaultChar=0x0) returned 21 [0051.343] lstrlenA (lpString="NqEQCVwFPSIorBW_.m4a") returned 20 [0051.344] lstrlenA (lpString=".badday") returned 7 [0051.344] lstrlenA (lpString=".badday") returned 7 [0051.344] lstrlenA (lpString="NqEQCVwFPSIorBW_.m4a") returned 20 [0051.344] lstrcmpiA (lpString1="BW_.m4a", lpString2=".badday") returned 1 [0051.344] lstrcmpiW (lpString1="NqEQCVwFPSIorBW_.m4a", lpString2="how_to_back_files.html") returned 1 [0051.344] lstrcmpiW (lpString1="NqEQCVwFPSIorBW_.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.344] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.344] lstrcmpiW (lpString1="NqEQCVwFPSIorBW_.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0051.344] GetProcessHeap () returned 0x560000 [0051.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0051.344] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\nqeqcvwfpsiorbw_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.344] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=71397) returned 1 [0051.344] GetProcessHeap () returned 0x560000 [0051.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.344] GetProcessHeap () returned 0x560000 [0051.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0051.344] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a") returned 89 [0051.344] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.344] GetProcessHeap () returned 0x560000 [0051.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.345] GetProcessHeap () returned 0x560000 [0051.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x5a3a00 [0051.345] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.345] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1b38) returned 1 [0051.345] CryptGenRandom (in: hProv=0x5a1b38, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.345] CryptReleaseContext (hProv=0x5a1b38, dwFlags=0x0) returned 1 [0051.345] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.345] GetProcessHeap () returned 0x560000 [0051.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.345] lstrlenA (lpString="010001") returned 6 [0051.345] GetProcessHeap () returned 0x560000 [0051.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0051.345] GetProcessHeap () returned 0x560000 [0051.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0051.345] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584d40 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584480 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5846b0 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584e58 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5868d0 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0051.346] GetProcessHeap () returned 0x560000 [0051.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.346] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3798 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5868d0 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3798 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b10 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868d0 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.347] GetProcessHeap () returned 0x560000 [0051.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.348] GetProcessHeap () returned 0x560000 [0051.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.349] GetProcessHeap () returned 0x560000 [0051.349] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.350] GetProcessHeap () returned 0x560000 [0051.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.351] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0051.351] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584480 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.352] GetProcessHeap () returned 0x560000 [0051.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.352] WriteFile (in: hFile=0x230, lpBuffer=0x5a3a00*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3a00*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0051.355] GetProcessHeap () returned 0x560000 [0051.355] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3a00, Size=0x30) returned 0x5a3a00 [0051.355] GetProcessHeap () returned 0x560000 [0051.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.355] GetProcessHeap () returned 0x560000 [0051.355] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x116f0) returned 0x5a4d18 [0051.357] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x116f0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x116f0, lpOverlapped=0x0) returned 1 [0051.358] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.358] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x116f0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x116f0, lpOverlapped=0x0) returned 1 [0051.363] GetProcessHeap () returned 0x560000 [0051.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0051.363] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.363] WriteFile (in: hFile=0x230, lpBuffer=0x5a3a00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3a00*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.364] CloseHandle (hObject=0x230) returned 1 [0051.365] GetProcessHeap () returned 0x560000 [0051.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0051.365] GetProcessHeap () returned 0x560000 [0051.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.365] GetProcessHeap () returned 0x560000 [0051.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0051.365] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a" [0051.365] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a.badday" [0051.365] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\nqeqcvwfpsiorbw_.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\nqeqcvwfpsiorbw_.m4a.badday"), dwFlags=0x1) returned 1 [0051.366] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\NqEQCVwFPSIorBW_.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS") returned 1 [0051.366] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned="" [0051.366] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" [0051.366] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\how_to_back_files.html")) returned 0x20 [0051.366] GetProcessHeap () returned 0x560000 [0051.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0051.366] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd5ccf0, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xd3429fc0, ftLastAccessTime.dwHighDateTime=0x1d4c8bd, ftLastWriteTime.dwLowDateTime=0xd3429fc0, ftLastWriteTime.dwHighDateTime=0x1d4c8bd, nFileSizeHigh=0x0, nFileSizeLow=0x10b96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zdfsVwNWdGTO.m4a", cAlternateFileName="ZDFSVW~1.M4A")) returned 1 [0051.366] lstrcmpiW (lpString1="zdfsVwNWdGTO.m4a", lpString2=".") returned 1 [0051.366] lstrcmpiW (lpString1="zdfsVwNWdGTO.m4a", lpString2="..") returned 1 [0051.366] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="zdfsVwNWdGTO.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a" [0051.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zdfsVwNWdGTO.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0051.366] GetProcessHeap () returned 0x560000 [0051.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576a58 [0051.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zdfsVwNWdGTO.m4a", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zdfsVwNWdGTO.m4a", lpUsedDefaultChar=0x0) returned 17 [0051.366] lstrlenA (lpString="zdfsVwNWdGTO.m4a") returned 16 [0051.366] lstrlenA (lpString=".badday") returned 7 [0051.366] lstrlenA (lpString=".badday") returned 7 [0051.366] lstrlenA (lpString="zdfsVwNWdGTO.m4a") returned 16 [0051.366] lstrcmpiA (lpString1="GTO.m4a", lpString2=".badday") returned 1 [0051.366] lstrcmpiW (lpString1="zdfsVwNWdGTO.m4a", lpString2="how_to_back_files.html") returned 1 [0051.366] lstrcmpiW (lpString1="zdfsVwNWdGTO.m4a", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.366] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.366] lstrcmpiW (lpString1="zdfsVwNWdGTO.m4a", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0051.366] GetProcessHeap () returned 0x560000 [0051.366] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0051.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\zdfsvwnwdgto.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.367] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=68502) returned 1 [0051.367] GetProcessHeap () returned 0x560000 [0051.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.367] GetProcessHeap () returned 0x560000 [0051.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.367] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a") returned 85 [0051.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.367] GetProcessHeap () returned 0x560000 [0051.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.367] GetProcessHeap () returned 0x560000 [0051.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38a) returned 0x5a3a38 [0051.367] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.367] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1670) returned 1 [0051.368] CryptGenRandom (in: hProv=0x5a1670, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.368] CryptReleaseContext (hProv=0x5a1670, dwFlags=0x0) returned 1 [0051.368] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0051.368] lstrlenA (lpString="010001") returned 6 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587380 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584368 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584e58 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584d40 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a15e8 [0051.368] GetProcessHeap () returned 0x560000 [0051.368] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5851a0 [0051.368] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587020 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a15e8 | out: hHeap=0x560000) returned 1 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5848e0 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587020 | out: hHeap=0x560000) returned 1 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3540 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f90 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3540 | out: hHeap=0x560000) returned 1 [0051.369] GetProcessHeap () returned 0x560000 [0051.369] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5846b0 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.370] GetProcessHeap () returned 0x560000 [0051.370] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.370] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.371] GetProcessHeap () returned 0x560000 [0051.371] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.372] GetProcessHeap () returned 0x560000 [0051.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.373] GetProcessHeap () returned 0x560000 [0051.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587380 | out: hHeap=0x560000) returned 1 [0051.374] GetProcessHeap () returned 0x560000 [0051.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0051.375] GetProcessHeap () returned 0x560000 [0051.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.375] GetProcessHeap () returned 0x560000 [0051.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0051.375] WriteFile (in: hFile=0x230, lpBuffer=0x5a3a38*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3a38*, lpNumberOfBytesWritten=0x24ad864*=0x38a, lpOverlapped=0x0) returned 1 [0051.377] GetProcessHeap () returned 0x560000 [0051.377] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3a38, Size=0x30) returned 0x5a3a38 [0051.377] GetProcessHeap () returned 0x560000 [0051.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.377] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.377] GetProcessHeap () returned 0x560000 [0051.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10ba0) returned 0x5a4d18 [0051.377] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x10ba0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x10ba0, lpOverlapped=0x0) returned 1 [0051.378] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.378] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x10ba0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x10ba0, lpOverlapped=0x0) returned 1 [0051.379] GetProcessHeap () returned 0x560000 [0051.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0051.381] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.381] WriteFile (in: hFile=0x230, lpBuffer=0x5a3a38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3a38*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.382] CloseHandle (hObject=0x230) returned 1 [0051.382] GetProcessHeap () returned 0x560000 [0051.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0051.382] GetProcessHeap () returned 0x560000 [0051.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.382] GetProcessHeap () returned 0x560000 [0051.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.382] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a" [0051.382] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a.badday") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a.badday" [0051.382] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\zdfsvwnwdgto.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a.badday" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\zdfsvwnwdgto.m4a.badday"), dwFlags=0x1) returned 1 [0051.383] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\zdfsVwNWdGTO.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS") returned 1 [0051.383] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS" | out: pszPath="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\") returned="" [0051.383] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" [0051.383] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\-_HxTeiwDnv\\0IT0Nf14ZLed\\UgNFA9D3VjM\\3ktLI17BS\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\music\\-_hxteiwdnv\\0it0nf14zled\\ugnfa9d3vjm\\3ktli17bs\\how_to_back_files.html")) returned 0x20 [0051.383] GetProcessHeap () returned 0x560000 [0051.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0051.383] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd5ccf0, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xd3429fc0, ftLastAccessTime.dwHighDateTime=0x1d4c8bd, ftLastWriteTime.dwLowDateTime=0xd3429fc0, ftLastWriteTime.dwHighDateTime=0x1d4c8bd, nFileSizeHigh=0x0, nFileSizeLow=0x10b96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zdfsVwNWdGTO.m4a", cAlternateFileName="ZDFSVW~1.M4A")) returned 0 [0051.383] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0051.383] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Local Settings\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0051.383] GetProcessHeap () returned 0x560000 [0051.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572d10 | out: hHeap=0x560000) returned 1 [0051.383] GetProcessHeap () returned 0x560000 [0051.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.383] lstrlenW (lpString="C:\\Users\\FD1HVy\\Local Settings\\") returned 31 [0051.383] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Local Settings\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\*") returned="C:\\Users\\FD1HVy\\Local Settings\\*" [0051.383] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd5ccf0, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xd3429fc0, ftLastAccessTime.dwHighDateTime=0x1d4c8bd, ftLastWriteTime.dwLowDateTime=0xd3429fc0, ftLastWriteTime.dwHighDateTime=0x1d4c8bd, nFileSizeHigh=0x0, nFileSizeLow=0x10b96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zdfsVwNWdGTO.m4a", cAlternateFileName="ZDFSVW~1.M4A")) returned 0xffffffff [0051.384] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0051.384] GetProcessHeap () returned 0x560000 [0051.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x582a30 | out: hHeap=0x560000) returned 1 [0051.384] GetProcessHeap () returned 0x560000 [0051.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.384] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\") returned 22 [0051.384] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Links\\*") returned="C:\\Users\\FD1HVy\\Links\\*" [0051.384] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0051.384] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.384] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.384] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.384] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.384] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.384] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.384] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.384] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini" [0051.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.385] GetProcessHeap () returned 0x560000 [0051.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0051.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0051.385] lstrlenA (lpString="desktop.ini") returned 11 [0051.385] lstrlenA (lpString=".badday") returned 7 [0051.385] lstrlenA (lpString=".badday") returned 7 [0051.385] lstrlenA (lpString="desktop.ini") returned 11 [0051.385] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0051.385] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0051.385] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.385] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.385] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.385] GetProcessHeap () returned 0x560000 [0051.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0051.385] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.385] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=504) returned 1 [0051.385] GetProcessHeap () returned 0x560000 [0051.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.385] GetProcessHeap () returned 0x560000 [0051.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0051.385] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned 33 [0051.385] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.385] GetProcessHeap () returned 0x560000 [0051.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.386] GetProcessHeap () returned 0x560000 [0051.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x5a3a70 [0051.386] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.386] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1808) returned 1 [0051.386] CryptGenRandom (in: hProv=0x5a1808, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.386] CryptReleaseContext (hProv=0x5a1808, dwFlags=0x0) returned 1 [0051.386] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.386] GetProcessHeap () returned 0x560000 [0051.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0051.386] lstrlenA (lpString="010001") returned 6 [0051.386] GetProcessHeap () returned 0x560000 [0051.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0051.386] GetProcessHeap () returned 0x560000 [0051.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2000 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2000 | out: hHeap=0x560000) returned 1 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584598 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5851a0 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5848e0 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3510 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5849f8 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0051.387] GetProcessHeap () returned 0x560000 [0051.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.387] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a34e0 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586de0 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a34e0 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b10 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.388] GetProcessHeap () returned 0x560000 [0051.388] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.389] GetProcessHeap () returned 0x560000 [0051.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.390] GetProcessHeap () returned 0x560000 [0051.390] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.391] GetProcessHeap () returned 0x560000 [0051.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.391] GetProcessHeap () returned 0x560000 [0051.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849f8 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.392] GetProcessHeap () returned 0x560000 [0051.392] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3510 | out: hHeap=0x560000) returned 1 [0051.393] GetProcessHeap () returned 0x560000 [0051.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0051.393] GetProcessHeap () returned 0x560000 [0051.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.393] GetProcessHeap () returned 0x560000 [0051.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0051.393] GetProcessHeap () returned 0x560000 [0051.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.393] GetProcessHeap () returned 0x560000 [0051.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.393] GetProcessHeap () returned 0x560000 [0051.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0051.393] WriteFile (in: hFile=0x230, lpBuffer=0x5a3a70*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3a70*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0051.396] GetProcessHeap () returned 0x560000 [0051.396] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3a70, Size=0x30) returned 0x5a3a70 [0051.396] GetProcessHeap () returned 0x560000 [0051.396] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.396] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.396] GetProcessHeap () returned 0x560000 [0051.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.397] ReadFile (in: hFile=0x230, lpBuffer=0x58a3b0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesRead=0x24ad7e8*=0x200, lpOverlapped=0x0) returned 1 [0051.397] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.397] WriteFile (in: hFile=0x230, lpBuffer=0x58a3b0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x200, lpOverlapped=0x0) returned 1 [0051.398] GetProcessHeap () returned 0x560000 [0051.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.398] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.398] WriteFile (in: hFile=0x230, lpBuffer=0x5a3a70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3a70*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.398] CloseHandle (hObject=0x230) returned 1 [0051.399] GetProcessHeap () returned 0x560000 [0051.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0051.399] GetProcessHeap () returned 0x560000 [0051.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.399] GetProcessHeap () returned 0x560000 [0051.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0051.399] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Links\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini" [0051.399] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini.badday" [0051.399] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0051.400] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0051.400] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0051.400] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" [0051.400] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\links\\how_to_back_files.html")) returned 0xffffffff [0051.400] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\links\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.401] GetProcessHeap () returned 0x560000 [0051.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.402] GetProcessHeap () returned 0x560000 [0051.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0051.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.410] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.411] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.412] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.413] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.419] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.420] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.421] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.422] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.423] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.424] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.426] GetProcessHeap () returned 0x560000 [0051.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.426] GetProcessHeap () returned 0x560000 [0051.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0051.426] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.426] GetProcessHeap () returned 0x560000 [0051.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.426] GetProcessHeap () returned 0x560000 [0051.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.475] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.476] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.479] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.480] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.482] GetProcessHeap () returned 0x560000 [0051.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.482] GetProcessHeap () returned 0x560000 [0051.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0051.482] CloseHandle (hObject=0x230) returned 1 [0051.482] GetProcessHeap () returned 0x560000 [0051.482] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.482] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0051.482] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0051.482] lstrcmpiW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0051.482] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" [0051.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.482] GetProcessHeap () returned 0x560000 [0051.482] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0051.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop.lnk", lpUsedDefaultChar=0x0) returned 12 [0051.482] lstrlenA (lpString="Desktop.lnk") returned 11 [0051.482] lstrlenA (lpString=".badday") returned 7 [0051.482] lstrlenA (lpString=".badday") returned 7 [0051.482] lstrlenA (lpString="Desktop.lnk") returned 11 [0051.483] lstrcmpiA (lpString1="top.lnk", lpString2=".badday") returned 1 [0051.483] lstrcmpiW (lpString1="Desktop.lnk", lpString2="how_to_back_files.html") returned -1 [0051.483] lstrcmpiW (lpString1="Desktop.lnk", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.483] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.483] lstrcmpiW (lpString1="Desktop.lnk", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.483] GetProcessHeap () returned 0x560000 [0051.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2b0 [0051.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.483] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=501) returned 1 [0051.483] GetProcessHeap () returned 0x560000 [0051.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.483] GetProcessHeap () returned 0x560000 [0051.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0051.483] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned 33 [0051.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.483] GetProcessHeap () returned 0x560000 [0051.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.483] GetProcessHeap () returned 0x560000 [0051.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38b) returned 0x5a3aa8 [0051.483] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.484] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2110) returned 1 [0051.484] CryptGenRandom (in: hProv=0x5a2110, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.484] CryptReleaseContext (hProv=0x5a2110, dwFlags=0x0) returned 1 [0051.484] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.484] GetProcessHeap () returned 0x560000 [0051.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a14d8 [0051.484] lstrlenA (lpString="010001") returned 6 [0051.484] GetProcessHeap () returned 0x560000 [0051.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0051.484] GetProcessHeap () returned 0x560000 [0051.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0051.484] GetProcessHeap () returned 0x560000 [0051.484] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0051.484] GetProcessHeap () returned 0x560000 [0051.484] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584b10 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584f70 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584480 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5851a0 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3750 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x585088 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3708 [0051.485] GetProcessHeap () returned 0x560000 [0051.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.485] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f90 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3708 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584368 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.486] GetProcessHeap () returned 0x560000 [0051.486] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.486] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.487] GetProcessHeap () returned 0x560000 [0051.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.487] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.488] GetProcessHeap () returned 0x560000 [0051.488] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.489] GetProcessHeap () returned 0x560000 [0051.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584480 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3750 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.490] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.490] GetProcessHeap () returned 0x560000 [0051.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0051.491] GetProcessHeap () returned 0x560000 [0051.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.491] GetProcessHeap () returned 0x560000 [0051.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.491] GetProcessHeap () returned 0x560000 [0051.491] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a14d8 | out: hHeap=0x560000) returned 1 [0051.491] WriteFile (in: hFile=0x230, lpBuffer=0x5a3aa8*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3aa8*, lpNumberOfBytesWritten=0x24ad864*=0x38b, lpOverlapped=0x0) returned 1 [0051.496] GetProcessHeap () returned 0x560000 [0051.496] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3aa8, Size=0x30) returned 0x5a3aa8 [0051.497] GetProcessHeap () returned 0x560000 [0051.497] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.497] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.497] GetProcessHeap () returned 0x560000 [0051.497] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.497] ReadFile (in: hFile=0x230, lpBuffer=0x58a3b0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesRead=0x24ad7e8*=0x200, lpOverlapped=0x0) returned 1 [0051.497] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.497] WriteFile (in: hFile=0x230, lpBuffer=0x58a3b0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58a3b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x200, lpOverlapped=0x0) returned 1 [0051.498] GetProcessHeap () returned 0x560000 [0051.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.498] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.498] WriteFile (in: hFile=0x230, lpBuffer=0x5a3aa8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3aa8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.499] CloseHandle (hObject=0x230) returned 1 [0051.499] GetProcessHeap () returned 0x560000 [0051.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2b0 | out: hHeap=0x560000) returned 1 [0051.499] GetProcessHeap () returned 0x560000 [0051.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.499] GetProcessHeap () returned 0x560000 [0051.499] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0051.499] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" [0051.499] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.badday") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.badday" [0051.499] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.badday" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.badday"), dwFlags=0x1) returned 1 [0051.500] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0051.500] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0051.500] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" [0051.500] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\links\\how_to_back_files.html")) returned 0x20 [0051.500] GetProcessHeap () returned 0x560000 [0051.500] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.500] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0051.500] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0051.500] lstrcmpiW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0051.500] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" [0051.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.500] GetProcessHeap () returned 0x560000 [0051.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0051.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads.lnk", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads.lnk", lpUsedDefaultChar=0x0) returned 14 [0051.500] lstrlenA (lpString="Downloads.lnk") returned 13 [0051.501] lstrlenA (lpString=".badday") returned 7 [0051.501] lstrlenA (lpString=".badday") returned 7 [0051.501] lstrlenA (lpString="Downloads.lnk") returned 13 [0051.501] lstrcmpiA (lpString1="ads.lnk", lpString2=".badday") returned 1 [0051.501] lstrcmpiW (lpString1="Downloads.lnk", lpString2="how_to_back_files.html") returned -1 [0051.501] lstrcmpiW (lpString1="Downloads.lnk", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.501] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.501] lstrcmpiW (lpString1="Downloads.lnk", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.501] GetProcessHeap () returned 0x560000 [0051.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0051.501] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.501] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=942) returned 1 [0051.501] GetProcessHeap () returned 0x560000 [0051.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.501] GetProcessHeap () returned 0x560000 [0051.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0051.501] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned 35 [0051.501] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.501] GetProcessHeap () returned 0x560000 [0051.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.501] GetProcessHeap () returned 0x560000 [0051.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x382) returned 0x5a3ae0 [0051.502] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.502] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2220) returned 1 [0051.502] CryptGenRandom (in: hProv=0x5a2220, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.502] CryptReleaseContext (hProv=0x5a2220, dwFlags=0x0) returned 1 [0051.502] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.502] GetProcessHeap () returned 0x560000 [0051.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0051.502] lstrlenA (lpString="010001") returned 6 [0051.502] GetProcessHeap () returned 0x560000 [0051.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.502] GetProcessHeap () returned 0x560000 [0051.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0051.502] GetProcessHeap () returned 0x560000 [0051.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586b10 [0051.502] GetProcessHeap () returned 0x560000 [0051.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5849f8 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584598 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584480 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3540 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x585088 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3708 [0051.503] GetProcessHeap () returned 0x560000 [0051.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5870b0 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3708 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584f70 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.504] GetProcessHeap () returned 0x560000 [0051.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.505] GetProcessHeap () returned 0x560000 [0051.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.506] GetProcessHeap () returned 0x560000 [0051.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.506] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.507] GetProcessHeap () returned 0x560000 [0051.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584480 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.508] GetProcessHeap () returned 0x560000 [0051.508] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3540 | out: hHeap=0x560000) returned 1 [0051.509] GetProcessHeap () returned 0x560000 [0051.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0051.509] GetProcessHeap () returned 0x560000 [0051.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849f8 | out: hHeap=0x560000) returned 1 [0051.509] GetProcessHeap () returned 0x560000 [0051.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b10 | out: hHeap=0x560000) returned 1 [0051.509] GetProcessHeap () returned 0x560000 [0051.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.509] GetProcessHeap () returned 0x560000 [0051.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.509] GetProcessHeap () returned 0x560000 [0051.509] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0051.509] WriteFile (in: hFile=0x230, lpBuffer=0x5a3ae0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3ae0*, lpNumberOfBytesWritten=0x24ad864*=0x382, lpOverlapped=0x0) returned 1 [0051.582] GetProcessHeap () returned 0x560000 [0051.582] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3ae0, Size=0x30) returned 0x5a3ae0 [0051.582] GetProcessHeap () returned 0x560000 [0051.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.582] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.582] GetProcessHeap () returned 0x560000 [0051.582] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3b0) returned 0x5a3b18 [0051.582] ReadFile (in: hFile=0x230, lpBuffer=0x5a3b18, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3b18*, lpNumberOfBytesRead=0x24ad7e8*=0x3b0, lpOverlapped=0x0) returned 1 [0051.582] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.582] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b18*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3b18*, lpNumberOfBytesWritten=0x24ad7e4*=0x3b0, lpOverlapped=0x0) returned 1 [0051.584] GetProcessHeap () returned 0x560000 [0051.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3b18 | out: hHeap=0x560000) returned 1 [0051.584] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.584] WriteFile (in: hFile=0x230, lpBuffer=0x5a3ae0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3ae0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.585] CloseHandle (hObject=0x230) returned 1 [0051.585] GetProcessHeap () returned 0x560000 [0051.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0051.586] GetProcessHeap () returned 0x560000 [0051.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.586] GetProcessHeap () returned 0x560000 [0051.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0051.586] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" [0051.586] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.badday") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.badday" [0051.586] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.badday" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.badday"), dwFlags=0x1) returned 1 [0051.586] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0051.586] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0051.586] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" [0051.586] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\links\\how_to_back_files.html")) returned 0x20 [0051.587] GetProcessHeap () returned 0x560000 [0051.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.587] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0051.587] lstrcmpiW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0051.587] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0051.587] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" [0051.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.587] GetProcessHeap () returned 0x560000 [0051.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd) returned 0x57ec40 [0051.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive.lnk", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneDrive.lnk", lpUsedDefaultChar=0x0) returned 13 [0051.587] lstrlenA (lpString="OneDrive.lnk") returned 12 [0051.587] lstrlenA (lpString=".badday") returned 7 [0051.587] lstrlenA (lpString=".badday") returned 7 [0051.587] lstrlenA (lpString="OneDrive.lnk") returned 12 [0051.587] lstrcmpiA (lpString1="ive.lnk", lpString2=".badday") returned 1 [0051.587] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="how_to_back_files.html") returned 1 [0051.587] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.587] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.587] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0051.587] GetProcessHeap () returned 0x560000 [0051.587] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d260 [0051.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.588] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=1338) returned 1 [0051.588] GetProcessHeap () returned 0x560000 [0051.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.588] GetProcessHeap () returned 0x560000 [0051.588] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1de0 [0051.588] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned 34 [0051.588] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.589] GetProcessHeap () returned 0x560000 [0051.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.589] GetProcessHeap () returned 0x560000 [0051.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x5a3b18 [0051.589] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.589] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2220) returned 1 [0051.589] CryptGenRandom (in: hProv=0x5a2220, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.589] CryptReleaseContext (hProv=0x5a2220, dwFlags=0x0) returned 1 [0051.589] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.589] GetProcessHeap () returned 0x560000 [0051.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0051.589] lstrlenA (lpString="010001") returned 6 [0051.589] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0188 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f5b8 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584598 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5846b0 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5848e0 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a36f0 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a00f8 [0051.590] GetProcessHeap () returned 0x560000 [0051.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.590] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b10 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a00f8 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a34b0 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fd98 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a34b0 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c28 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.591] GetProcessHeap () returned 0x560000 [0051.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.591] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.592] GetProcessHeap () returned 0x560000 [0051.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.592] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.593] GetProcessHeap () returned 0x560000 [0051.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.593] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.594] GetProcessHeap () returned 0x560000 [0051.594] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.594] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.595] GetProcessHeap () returned 0x560000 [0051.595] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.595] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c28 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a36f0 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5b8 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0188 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.596] GetProcessHeap () returned 0x560000 [0051.596] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0051.596] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b18*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3b18*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0051.600] GetProcessHeap () returned 0x560000 [0051.600] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3b18, Size=0x30) returned 0x5a3b18 [0051.600] GetProcessHeap () returned 0x560000 [0051.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.600] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.600] GetProcessHeap () returned 0x560000 [0051.600] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x540) returned 0x5a3b50 [0051.600] ReadFile (in: hFile=0x230, lpBuffer=0x5a3b50, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a3b50*, lpNumberOfBytesRead=0x24ad7e8*=0x540, lpOverlapped=0x0) returned 1 [0051.600] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.600] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b50*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3b50*, lpNumberOfBytesWritten=0x24ad7e4*=0x540, lpOverlapped=0x0) returned 1 [0051.601] GetProcessHeap () returned 0x560000 [0051.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3b50 | out: hHeap=0x560000) returned 1 [0051.601] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.601] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3b18*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.603] CloseHandle (hObject=0x230) returned 1 [0051.603] GetProcessHeap () returned 0x560000 [0051.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d260 | out: hHeap=0x560000) returned 1 [0051.603] GetProcessHeap () returned 0x560000 [0051.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.603] GetProcessHeap () returned 0x560000 [0051.603] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1de0 | out: hHeap=0x560000) returned 1 [0051.603] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" [0051.603] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.badday") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.badday" [0051.603] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.badday" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.badday"), dwFlags=0x1) returned 1 [0051.604] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0051.604] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0051.604] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" [0051.604] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\links\\how_to_back_files.html")) returned 0x20 [0051.604] GetProcessHeap () returned 0x560000 [0051.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.604] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0051.604] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0051.604] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0051.604] GetProcessHeap () returned 0x560000 [0051.604] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579708 | out: hHeap=0x560000) returned 1 [0051.604] GetProcessHeap () returned 0x560000 [0051.605] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.605] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\") returned 26 [0051.605] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\*") returned="C:\\Users\\FD1HVy\\Favorites\\*" [0051.605] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0051.605] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.605] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.605] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.605] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.605] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0051.605] lstrcmpiW (lpString1="Bing.url", lpString2=".") returned 1 [0051.605] lstrcmpiW (lpString1="Bing.url", lpString2="..") returned 1 [0051.605] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Bing.url" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0051.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Bing.url", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.605] GetProcessHeap () returned 0x560000 [0051.605] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0051.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Bing.url", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bing.url", lpUsedDefaultChar=0x0) returned 9 [0051.605] lstrlenA (lpString="Bing.url") returned 8 [0051.605] lstrlenA (lpString=".badday") returned 7 [0051.605] lstrlenA (lpString=".badday") returned 7 [0051.605] lstrlenA (lpString="Bing.url") returned 8 [0051.605] lstrcmpiA (lpString1="ing.url", lpString2=".badday") returned 1 [0051.605] lstrcmpiW (lpString1="Bing.url", lpString2="how_to_back_files.html") returned -1 [0051.605] lstrcmpiW (lpString1="Bing.url", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.605] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.605] lstrcmpiW (lpString1="Bing.url", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.605] GetProcessHeap () returned 0x560000 [0051.605] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0051.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.607] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=208) returned 1 [0051.607] GetProcessHeap () returned 0x560000 [0051.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.607] GetProcessHeap () returned 0x560000 [0051.607] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0051.608] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned 34 [0051.608] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.608] GetProcessHeap () returned 0x560000 [0051.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.608] GetProcessHeap () returned 0x560000 [0051.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a3b50 [0051.608] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.608] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1b38) returned 1 [0051.608] CryptGenRandom (in: hProv=0x5a1b38, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.608] CryptReleaseContext (hProv=0x5a1b38, dwFlags=0x0) returned 1 [0051.608] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.608] GetProcessHeap () returned 0x560000 [0051.608] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1560 [0051.609] lstrlenA (lpString="010001") returned 6 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1450 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f888 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f768 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5851a0 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584e58 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584480 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1670 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5848e0 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3528 [0051.609] GetProcessHeap () returned 0x560000 [0051.609] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0068 [0051.609] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1670 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c28 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0068 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a34c8 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f918 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a34c8 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584368 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f918 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.610] GetProcessHeap () returned 0x560000 [0051.610] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.611] GetProcessHeap () returned 0x560000 [0051.611] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.611] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.612] GetProcessHeap () returned 0x560000 [0051.612] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.613] GetProcessHeap () returned 0x560000 [0051.613] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.613] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.614] GetProcessHeap () returned 0x560000 [0051.614] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.614] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584480 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c28 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3528 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f768 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f888 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.615] GetProcessHeap () returned 0x560000 [0051.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1560 | out: hHeap=0x560000) returned 1 [0051.615] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b50*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3b50*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0051.619] GetProcessHeap () returned 0x560000 [0051.619] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3b50, Size=0x30) returned 0x5a3b50 [0051.619] GetProcessHeap () returned 0x560000 [0051.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.619] GetProcessHeap () returned 0x560000 [0051.619] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd0) returned 0x57aad0 [0051.619] ReadFile (in: hFile=0x230, lpBuffer=0x57aad0, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x57aad0*, lpNumberOfBytesRead=0x24ad7e8*=0xd0, lpOverlapped=0x0) returned 1 [0051.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.619] WriteFile (in: hFile=0x230, lpBuffer=0x57aad0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x57aad0*, lpNumberOfBytesWritten=0x24ad7e4*=0xd0, lpOverlapped=0x0) returned 1 [0051.620] GetProcessHeap () returned 0x560000 [0051.620] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57aad0 | out: hHeap=0x560000) returned 1 [0051.620] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.620] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3b50*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.621] CloseHandle (hObject=0x230) returned 1 [0051.622] GetProcessHeap () returned 0x560000 [0051.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0051.622] GetProcessHeap () returned 0x560000 [0051.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.622] GetProcessHeap () returned 0x560000 [0051.622] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0051.622] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Favorites\\Bing.url" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0051.622] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url.badday") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url.badday" [0051.622] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.badday" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.badday"), dwFlags=0x1) returned 1 [0051.622] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Bing.url" | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0051.623] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Favorites" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\") returned="" [0051.623] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html" [0051.623] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\favorites\\how_to_back_files.html")) returned 0xffffffff [0051.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\favorites\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.624] GetProcessHeap () returned 0x560000 [0051.624] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.624] GetProcessHeap () returned 0x560000 [0051.624] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0051.631] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.636] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.637] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.640] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.642] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.643] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.644] GetProcessHeap () returned 0x560000 [0051.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.644] GetProcessHeap () returned 0x560000 [0051.644] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0051.644] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.644] GetProcessHeap () returned 0x560000 [0051.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.644] GetProcessHeap () returned 0x560000 [0051.644] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0051.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.651] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.652] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.654] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.656] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.658] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.660] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.660] GetProcessHeap () returned 0x560000 [0051.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.660] GetProcessHeap () returned 0x560000 [0051.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0051.660] CloseHandle (hObject=0x230) returned 1 [0051.660] GetProcessHeap () returned 0x560000 [0051.660] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.660] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.661] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.661] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.661] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" [0051.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.661] GetProcessHeap () returned 0x560000 [0051.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0051.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0051.661] lstrlenA (lpString="desktop.ini") returned 11 [0051.661] lstrlenA (lpString=".badday") returned 7 [0051.661] lstrlenA (lpString=".badday") returned 7 [0051.661] lstrlenA (lpString="desktop.ini") returned 11 [0051.661] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0051.661] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0051.661] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.661] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.661] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.661] GetProcessHeap () returned 0x560000 [0051.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0051.661] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.661] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=402) returned 1 [0051.661] GetProcessHeap () returned 0x560000 [0051.661] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.661] GetProcessHeap () returned 0x560000 [0051.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0051.662] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned 37 [0051.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.662] GetProcessHeap () returned 0x560000 [0051.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.662] GetProcessHeap () returned 0x560000 [0051.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x5a3438 [0051.662] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.662] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a22a8) returned 1 [0051.662] CryptGenRandom (in: hProv=0x5a22a8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.662] CryptReleaseContext (hProv=0x5a22a8, dwFlags=0x0) returned 1 [0051.662] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.662] GetProcessHeap () returned 0x560000 [0051.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0051.662] lstrlenA (lpString="010001") returned 6 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f408 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f648 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5846b0 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584d40 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c28 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5848e0 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589b48 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fc78 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0051.663] GetProcessHeap () returned 0x560000 [0051.663] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584e58 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc78 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bd8 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f9a8 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bd8 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584598 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f9a8 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.664] GetProcessHeap () returned 0x560000 [0051.664] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.664] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.665] GetProcessHeap () returned 0x560000 [0051.665] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.666] GetProcessHeap () returned 0x560000 [0051.666] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.686] GetProcessHeap () returned 0x560000 [0051.686] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.686] GetProcessHeap () returned 0x560000 [0051.686] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.686] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.687] GetProcessHeap () returned 0x560000 [0051.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.688] GetProcessHeap () returned 0x560000 [0051.688] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.688] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c28 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848e0 | out: hHeap=0x560000) returned 1 [0051.689] GetProcessHeap () returned 0x560000 [0051.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589b48 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f648 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846b0 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.690] GetProcessHeap () returned 0x560000 [0051.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0051.690] WriteFile (in: hFile=0x230, lpBuffer=0x5a3438*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3438*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0051.697] GetProcessHeap () returned 0x560000 [0051.697] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3438, Size=0x30) returned 0x5a3438 [0051.697] GetProcessHeap () returned 0x560000 [0051.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.697] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.697] GetProcessHeap () returned 0x560000 [0051.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a0) returned 0x5703a0 [0051.697] ReadFile (in: hFile=0x230, lpBuffer=0x5703a0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesRead=0x24ad7e8*=0x1a0, lpOverlapped=0x0) returned 1 [0051.697] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.697] WriteFile (in: hFile=0x230, lpBuffer=0x5703a0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesWritten=0x24ad7e4*=0x1a0, lpOverlapped=0x0) returned 1 [0051.698] GetProcessHeap () returned 0x560000 [0051.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0051.698] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.698] WriteFile (in: hFile=0x230, lpBuffer=0x5a3438*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3438*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.699] CloseHandle (hObject=0x230) returned 1 [0051.700] GetProcessHeap () returned 0x560000 [0051.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0051.700] GetProcessHeap () returned 0x560000 [0051.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.700] GetProcessHeap () returned 0x560000 [0051.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0051.700] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" [0051.700] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.badday" [0051.700] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0051.702] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0051.702] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Favorites" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\") returned="" [0051.702] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html" [0051.702] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\favorites\\how_to_back_files.html")) returned 0x20 [0051.702] GetProcessHeap () returned 0x560000 [0051.702] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.702] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0051.702] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0051.702] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0051.702] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0051.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.702] GetProcessHeap () returned 0x560000 [0051.702] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x58a058 [0051.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x58a058, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Links", lpUsedDefaultChar=0x0) returned 6 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0051.702] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0051.703] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0051.704] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0051.704] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0051.704] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0051.704] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0051.704] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0051.704] GetProcessHeap () returned 0x560000 [0051.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a008 [0051.704] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned 32 [0051.704] GetProcessHeap () returned 0x560000 [0051.704] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x42) returned 0x585aa0 [0051.704] lstrcpyW (in: lpString1=0x585aa0, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0051.704] GetProcessHeap () returned 0x560000 [0051.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0051.704] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0051.704] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0051.704] GetProcessHeap () returned 0x560000 [0051.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585aa0 | out: hHeap=0x560000) returned 1 [0051.704] GetProcessHeap () returned 0x560000 [0051.704] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.704] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned 32 [0051.704] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\*" [0051.704] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0051.704] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.705] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.705] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.705] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.705] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.705] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.705] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.705] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" [0051.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.705] GetProcessHeap () returned 0x560000 [0051.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0051.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0051.705] lstrlenA (lpString="desktop.ini") returned 11 [0051.705] lstrlenA (lpString=".badday") returned 7 [0051.705] lstrlenA (lpString=".badday") returned 7 [0051.705] lstrlenA (lpString="desktop.ini") returned 11 [0051.705] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0051.705] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0051.705] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.705] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.705] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.705] GetProcessHeap () returned 0x560000 [0051.705] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0051.705] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.705] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=80) returned 1 [0051.706] GetProcessHeap () returned 0x560000 [0051.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.706] GetProcessHeap () returned 0x560000 [0051.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0051.706] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned 43 [0051.706] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.706] GetProcessHeap () returned 0x560000 [0051.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.706] GetProcessHeap () returned 0x560000 [0051.706] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a3470 [0051.706] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.706] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1d58) returned 1 [0051.706] CryptGenRandom (in: hProv=0x5a1d58, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.706] CryptReleaseContext (hProv=0x5a1d58, dwFlags=0x0) returned 1 [0051.706] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0051.707] lstrlenA (lpString="010001") returned 6 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fac8 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f768 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584b10 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584c28 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584e58 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584d40 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3d50 [0051.707] GetProcessHeap () returned 0x560000 [0051.707] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0338 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x585088 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0338 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3d80 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fd98 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d80 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5849f8 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.708] GetProcessHeap () returned 0x560000 [0051.708] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.709] GetProcessHeap () returned 0x560000 [0051.709] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.710] GetProcessHeap () returned 0x560000 [0051.710] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.711] GetProcessHeap () returned 0x560000 [0051.711] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.712] GetProcessHeap () returned 0x560000 [0051.712] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849f8 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d50 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f768 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c28 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.713] GetProcessHeap () returned 0x560000 [0051.713] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0051.713] WriteFile (in: hFile=0x230, lpBuffer=0x5a3470*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3470*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0051.717] GetProcessHeap () returned 0x560000 [0051.717] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3470, Size=0x30) returned 0x5a3470 [0051.717] GetProcessHeap () returned 0x560000 [0051.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.717] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.717] GetProcessHeap () returned 0x560000 [0051.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x50) returned 0x58e2b8 [0051.717] ReadFile (in: hFile=0x230, lpBuffer=0x58e2b8, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x58e2b8*, lpNumberOfBytesRead=0x24ad7e8*=0x50, lpOverlapped=0x0) returned 1 [0051.717] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.717] WriteFile (in: hFile=0x230, lpBuffer=0x58e2b8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x58e2b8*, lpNumberOfBytesWritten=0x24ad7e4*=0x50, lpOverlapped=0x0) returned 1 [0051.718] GetProcessHeap () returned 0x560000 [0051.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e2b8 | out: hHeap=0x560000) returned 1 [0051.718] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.718] WriteFile (in: hFile=0x230, lpBuffer=0x5a3470*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3470*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.719] CloseHandle (hObject=0x230) returned 1 [0051.720] GetProcessHeap () returned 0x560000 [0051.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0051.720] GetProcessHeap () returned 0x560000 [0051.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.720] GetProcessHeap () returned 0x560000 [0051.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0051.720] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" [0051.720] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.badday" [0051.720] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0051.720] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links") returned 1 [0051.720] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="" [0051.720] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\how_to_back_files.html" [0051.720] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\how_to_back_files.html")) returned 0xffffffff [0051.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.721] GetProcessHeap () returned 0x560000 [0051.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.721] GetProcessHeap () returned 0x560000 [0051.721] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0051.728] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.729] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.732] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.732] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.732] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.732] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.732] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.732] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.736] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.737] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.738] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.739] GetProcessHeap () returned 0x560000 [0051.739] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.739] GetProcessHeap () returned 0x560000 [0051.739] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0051.739] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.739] GetProcessHeap () returned 0x560000 [0051.740] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.740] GetProcessHeap () returned 0x560000 [0051.740] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.748] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.750] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.752] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.754] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.755] GetProcessHeap () returned 0x560000 [0051.755] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.755] GetProcessHeap () returned 0x560000 [0051.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0051.756] CloseHandle (hObject=0x230) returned 1 [0051.756] GetProcessHeap () returned 0x560000 [0051.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.756] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0051.756] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0051.756] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Downloads\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0051.756] GetProcessHeap () returned 0x560000 [0051.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579508 | out: hHeap=0x560000) returned 1 [0051.756] GetProcessHeap () returned 0x560000 [0051.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.756] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\") returned 26 [0051.756] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\*") returned="C:\\Users\\FD1HVy\\Downloads\\*" [0051.756] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579808 [0051.756] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.756] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.756] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.756] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.756] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.756] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.757] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.757] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" [0051.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.757] GetProcessHeap () returned 0x560000 [0051.757] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0051.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0051.757] lstrlenA (lpString="desktop.ini") returned 11 [0051.757] lstrlenA (lpString=".badday") returned 7 [0051.757] lstrlenA (lpString=".badday") returned 7 [0051.757] lstrlenA (lpString="desktop.ini") returned 11 [0051.757] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0051.757] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0051.757] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.757] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.757] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.757] GetProcessHeap () returned 0x560000 [0051.757] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0051.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.757] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=282) returned 1 [0051.757] GetProcessHeap () returned 0x560000 [0051.757] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.757] GetProcessHeap () returned 0x560000 [0051.757] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1c48 [0051.757] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned 37 [0051.757] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.758] GetProcessHeap () returned 0x560000 [0051.758] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.758] GetProcessHeap () returned 0x560000 [0051.758] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x5a34a8 [0051.758] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.758] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1f78) returned 1 [0051.758] CryptGenRandom (in: hProv=0x5a1f78, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.758] CryptReleaseContext (hProv=0x5a1f78, dwFlags=0x0) returned 1 [0051.758] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.758] GetProcessHeap () returned 0x560000 [0051.758] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0051.758] lstrlenA (lpString="010001") returned 6 [0051.758] GetProcessHeap () returned 0x560000 [0051.758] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ff48 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fac8 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584c28 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584598 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5847c8 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2220 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584d40 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3f60 [0051.759] GetProcessHeap () returned 0x560000 [0051.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0068 [0051.759] GetProcessHeap () returned 0x560000 [0051.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2220 | out: hHeap=0x560000) returned 1 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584b10 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0068 | out: hHeap=0x560000) returned 1 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3f78 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.768] GetProcessHeap () returned 0x560000 [0051.768] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fd98 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3f78 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584f70 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.769] GetProcessHeap () returned 0x560000 [0051.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.770] GetProcessHeap () returned 0x560000 [0051.770] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.770] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.771] GetProcessHeap () returned 0x560000 [0051.771] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.771] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.772] GetProcessHeap () returned 0x560000 [0051.772] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.772] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847c8 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584b10 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3f60 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c28 | out: hHeap=0x560000) returned 1 [0051.773] GetProcessHeap () returned 0x560000 [0051.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff48 | out: hHeap=0x560000) returned 1 [0051.774] GetProcessHeap () returned 0x560000 [0051.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584598 | out: hHeap=0x560000) returned 1 [0051.774] GetProcessHeap () returned 0x560000 [0051.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.774] GetProcessHeap () returned 0x560000 [0051.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0051.774] WriteFile (in: hFile=0x230, lpBuffer=0x5a34a8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a34a8*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0051.787] GetProcessHeap () returned 0x560000 [0051.787] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a34a8, Size=0x30) returned 0x5a34a8 [0051.787] GetProcessHeap () returned 0x560000 [0051.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.787] GetProcessHeap () returned 0x560000 [0051.787] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x120) returned 0x585348 [0051.787] ReadFile (in: hFile=0x230, lpBuffer=0x585348, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x585348*, lpNumberOfBytesRead=0x24ad7e8*=0x120, lpOverlapped=0x0) returned 1 [0051.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.787] WriteFile (in: hFile=0x230, lpBuffer=0x585348*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x585348*, lpNumberOfBytesWritten=0x24ad7e4*=0x120, lpOverlapped=0x0) returned 1 [0051.788] GetProcessHeap () returned 0x560000 [0051.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585348 | out: hHeap=0x560000) returned 1 [0051.788] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.789] WriteFile (in: hFile=0x230, lpBuffer=0x5a34a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a34a8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.789] CloseHandle (hObject=0x230) returned 1 [0051.790] GetProcessHeap () returned 0x560000 [0051.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0051.790] GetProcessHeap () returned 0x560000 [0051.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.790] GetProcessHeap () returned 0x560000 [0051.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1c48 | out: hHeap=0x560000) returned 1 [0051.790] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" [0051.790] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.badday" [0051.790] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0051.791] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Downloads") returned 1 [0051.792] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Downloads" | out: pszPath="C:\\Users\\FD1HVy\\Downloads\\") returned="" [0051.792] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Downloads\\how_to_back_files.html" [0051.792] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\downloads\\how_to_back_files.html")) returned 0xffffffff [0051.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\downloads\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.793] GetProcessHeap () returned 0x560000 [0051.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.793] GetProcessHeap () returned 0x560000 [0051.793] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1e68 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.802] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.803] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.806] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.807] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.808] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] GetProcessHeap () returned 0x560000 [0051.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.811] GetProcessHeap () returned 0x560000 [0051.811] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e68 | out: hHeap=0x560000) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.811] GetProcessHeap () returned 0x560000 [0051.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.811] GetProcessHeap () returned 0x560000 [0051.811] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.820] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.821] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.822] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.823] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.828] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.829] GetProcessHeap () returned 0x560000 [0051.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.829] GetProcessHeap () returned 0x560000 [0051.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0051.829] CloseHandle (hObject=0x230) returned 1 [0051.829] GetProcessHeap () returned 0x560000 [0051.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0051.829] FindNextFileW (in: hFindFile=0x579808, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0051.829] FindClose (in: hFindFile=0x579808 | out: hFindFile=0x579808) returned 1 [0051.829] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0051.829] GetProcessHeap () returned 0x560000 [0051.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579608 | out: hHeap=0x560000) returned 1 [0051.829] GetProcessHeap () returned 0x560000 [0051.829] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0051.829] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\") returned 26 [0051.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\*") returned="C:\\Users\\FD1HVy\\Documents\\*" [0051.829] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x539eff8e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x539eff8e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579608 [0051.830] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.830] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x539eff8e, ftLastAccessTime.dwHighDateTime=0x1d5782b, ftLastWriteTime.dwLowDateTime=0x539eff8e, ftLastWriteTime.dwHighDateTime=0x1d5782b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.830] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.830] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.830] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b206a0, ftCreationTime.dwHighDateTime=0x1d56b95, ftLastAccessTime.dwLowDateTime=0xba96dc30, ftLastAccessTime.dwHighDateTime=0x1d55430, ftLastWriteTime.dwLowDateTime=0xba96dc30, ftLastWriteTime.dwHighDateTime=0x1d55430, nFileSizeHigh=0x0, nFileSizeLow=0x4156, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-KnxCh.pptx", cAlternateFileName="-KNXCH~1.PPT")) returned 1 [0051.830] lstrcmpiW (lpString1="-KnxCh.pptx", lpString2=".") returned 1 [0051.830] lstrcmpiW (lpString1="-KnxCh.pptx", lpString2="..") returned 1 [0051.830] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="-KnxCh.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx") returned="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx" [0051.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-KnxCh.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.830] GetProcessHeap () returned 0x560000 [0051.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0051.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-KnxCh.pptx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-KnxCh.pptx", lpUsedDefaultChar=0x0) returned 12 [0051.830] lstrlenA (lpString="-KnxCh.pptx") returned 11 [0051.830] lstrlenA (lpString=".badday") returned 7 [0051.830] lstrlenA (lpString=".badday") returned 7 [0051.830] lstrlenA (lpString="-KnxCh.pptx") returned 11 [0051.830] lstrcmpiA (lpString1="Ch.pptx", lpString2=".badday") returned 1 [0051.830] lstrcmpiW (lpString1="-KnxCh.pptx", lpString2="how_to_back_files.html") returned 1 [0051.830] lstrcmpiW (lpString1="-KnxCh.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0051.830] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0051.830] lstrcmpiW (lpString1="-KnxCh.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0051.830] GetProcessHeap () returned 0x560000 [0051.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0051.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-knxch.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.831] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=16726) returned 1 [0051.831] GetProcessHeap () returned 0x560000 [0051.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.831] GetProcessHeap () returned 0x560000 [0051.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0051.831] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx") returned 37 [0051.831] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.831] GetProcessHeap () returned 0x560000 [0051.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0051.831] GetProcessHeap () returned 0x560000 [0051.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38a) returned 0x5a3f90 [0051.831] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.831] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1cd0) returned 1 [0051.831] CryptGenRandom (in: hProv=0x5a1cd0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0051.832] CryptReleaseContext (hProv=0x5a1cd0, dwFlags=0x0) returned 1 [0051.832] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1b38 [0051.832] lstrlenA (lpString="010001") returned 6 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59feb8 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a02a8 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x584d40 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584e58 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5851a0 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x584f70 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.832] GetProcessHeap () returned 0x560000 [0051.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3c48 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fc78 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x585088 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc78 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3e70 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5a0188 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3e70 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x584368 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0188 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.833] GetProcessHeap () returned 0x560000 [0051.833] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.833] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.834] GetProcessHeap () returned 0x560000 [0051.834] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.835] GetProcessHeap () returned 0x560000 [0051.835] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.836] GetProcessHeap () returned 0x560000 [0051.836] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.836] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0051.837] GetProcessHeap () returned 0x560000 [0051.837] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5851a0 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f70 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3c48 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d40 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59feb8 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e58 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0051.990] GetProcessHeap () returned 0x560000 [0051.990] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1b38 | out: hHeap=0x560000) returned 1 [0051.991] WriteFile (in: hFile=0x230, lpBuffer=0x5a3f90*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3f90*, lpNumberOfBytesWritten=0x24ad864*=0x38a, lpOverlapped=0x0) returned 1 [0051.993] GetProcessHeap () returned 0x560000 [0051.993] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3f90, Size=0x30) returned 0x5a3f90 [0051.993] GetProcessHeap () returned 0x560000 [0051.993] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0051.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.993] GetProcessHeap () returned 0x560000 [0051.993] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4160) returned 0x5a4d18 [0051.995] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x4160, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x4160, lpOverlapped=0x0) returned 1 [0051.995] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.995] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x4160, lpOverlapped=0x0) returned 1 [0051.996] GetProcessHeap () returned 0x560000 [0051.996] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0051.996] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0051.996] WriteFile (in: hFile=0x230, lpBuffer=0x5a3f90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3f90*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0051.997] CloseHandle (hObject=0x230) returned 1 [0051.997] GetProcessHeap () returned 0x560000 [0051.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0051.997] GetProcessHeap () returned 0x560000 [0051.997] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0051.998] GetProcessHeap () returned 0x560000 [0051.998] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0051.998] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx") returned="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx" [0051.998] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx.badday" [0051.998] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-knxch.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\-knxch.pptx.badday"), dwFlags=0x1) returned 1 [0051.998] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\-KnxCh.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0051.998] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0051.998] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0051.998] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0xffffffff [0051.999] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.999] GetProcessHeap () returned 0x560000 [0051.999] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0051.999] GetProcessHeap () returned 0x560000 [0051.999] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0052.005] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.012] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.013] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.016] GetProcessHeap () returned 0x560000 [0052.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.016] GetProcessHeap () returned 0x560000 [0052.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0052.016] GetProcessHeap () returned 0x560000 [0052.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.016] GetProcessHeap () returned 0x560000 [0052.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.028] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.029] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.030] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.032] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.032] GetProcessHeap () returned 0x560000 [0052.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.032] GetProcessHeap () returned 0x560000 [0052.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0052.032] CloseHandle (hObject=0x230) returned 1 [0052.032] GetProcessHeap () returned 0x560000 [0052.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.032] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f809fb0, ftCreationTime.dwHighDateTime=0x1d4d12a, ftLastAccessTime.dwLowDateTime=0x67916cb0, ftLastAccessTime.dwHighDateTime=0x1d4c689, ftLastWriteTime.dwLowDateTime=0x67916cb0, ftLastWriteTime.dwHighDateTime=0x1d4c689, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="73cd5wHU_4", cAlternateFileName="73CD5W~1")) returned 1 [0052.032] lstrcmpiW (lpString1="73cd5wHU_4", lpString2=".") returned 1 [0052.032] lstrcmpiW (lpString1="73cd5wHU_4", lpString2="..") returned 1 [0052.032] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="73cd5wHU_4" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4" [0052.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="73cd5wHU_4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.033] GetProcessHeap () returned 0x560000 [0052.033] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0052.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="73cd5wHU_4", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="73cd5wHU_4", lpUsedDefaultChar=0x0) returned 11 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.033] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.034] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="73cd5wHU_4", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.034] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\" [0052.034] GetProcessHeap () returned 0x560000 [0052.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a048 [0052.034] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned 37 [0052.034] GetProcessHeap () returned 0x560000 [0052.034] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4c) returned 0x58e310 [0052.034] lstrcpyW (in: lpString1=0x58e310, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\" [0052.034] GetProcessHeap () returned 0x560000 [0052.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.034] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0064e60, ftCreationTime.dwHighDateTime=0x1d564b3, ftLastAccessTime.dwLowDateTime=0x1f079200, ftLastAccessTime.dwHighDateTime=0x1d52ef6, ftLastWriteTime.dwLowDateTime=0x1f079200, ftLastWriteTime.dwHighDateTime=0x1d52ef6, nFileSizeHigh=0x0, nFileSizeLow=0x7d50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8j6IpMUpIfK9Bp8nkPD.xlsx", cAlternateFileName="8J6IPM~1.XLS")) returned 1 [0052.034] lstrcmpiW (lpString1="8j6IpMUpIfK9Bp8nkPD.xlsx", lpString2=".") returned 1 [0052.034] lstrcmpiW (lpString1="8j6IpMUpIfK9Bp8nkPD.xlsx", lpString2="..") returned 1 [0052.034] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="8j6IpMUpIfK9Bp8nkPD.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx" [0052.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8j6IpMUpIfK9Bp8nkPD.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0052.034] GetProcessHeap () returned 0x560000 [0052.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d3c8 [0052.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8j6IpMUpIfK9Bp8nkPD.xlsx", cchWideChar=-1, lpMultiByteStr=0x57d3c8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8j6IpMUpIfK9Bp8nkPD.xlsx", lpUsedDefaultChar=0x0) returned 25 [0052.035] lstrlenA (lpString="8j6IpMUpIfK9Bp8nkPD.xlsx") returned 24 [0052.035] lstrlenA (lpString=".badday") returned 7 [0052.035] lstrlenA (lpString=".badday") returned 7 [0052.035] lstrlenA (lpString="8j6IpMUpIfK9Bp8nkPD.xlsx") returned 24 [0052.035] lstrcmpiA (lpString1="PD.xlsx", lpString2=".badday") returned 1 [0052.035] lstrcmpiW (lpString1="8j6IpMUpIfK9Bp8nkPD.xlsx", lpString2="how_to_back_files.html") returned -1 [0052.035] lstrcmpiW (lpString1="8j6IpMUpIfK9Bp8nkPD.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0052.035] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.035] lstrcmpiW (lpString1="8j6IpMUpIfK9Bp8nkPD.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.035] GetProcessHeap () returned 0x560000 [0052.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d4b8 [0052.035] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\8j6ipmupifk9bp8nkpd.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.035] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=32080) returned 1 [0052.035] GetProcessHeap () returned 0x560000 [0052.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.035] GetProcessHeap () returned 0x560000 [0052.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a19a0 [0052.035] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx") returned 50 [0052.035] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.035] GetProcessHeap () returned 0x560000 [0052.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.035] GetProcessHeap () returned 0x560000 [0052.035] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a3fc8 [0052.035] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.036] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2220) returned 1 [0052.036] CryptGenRandom (in: hProv=0x5a2220, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.036] CryptReleaseContext (hProv=0x5a2220, dwFlags=0x0) returned 1 [0052.036] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.036] GetProcessHeap () returned 0x560000 [0052.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2000 [0052.036] lstrlenA (lpString="010001") returned 6 [0052.036] GetProcessHeap () returned 0x560000 [0052.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0052.036] GetProcessHeap () returned 0x560000 [0052.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0052.036] GetProcessHeap () returned 0x560000 [0052.036] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585178 [0052.036] GetProcessHeap () returned 0x560000 [0052.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0052.036] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584ab8 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586948 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1c48 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586600 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843f8 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1c48 | out: hHeap=0x560000) returned 1 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843f8 | out: hHeap=0x560000) returned 1 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3bd0 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.037] GetProcessHeap () returned 0x560000 [0052.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584cf8 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3bd0 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.038] GetProcessHeap () returned 0x560000 [0052.038] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.038] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.039] GetProcessHeap () returned 0x560000 [0052.039] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.039] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.040] GetProcessHeap () returned 0x560000 [0052.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.041] GetProcessHeap () returned 0x560000 [0052.041] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.041] GetProcessHeap () returned 0x560000 [0052.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.045] GetProcessHeap () returned 0x560000 [0052.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.045] GetProcessHeap () returned 0x560000 [0052.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.045] GetProcessHeap () returned 0x560000 [0052.045] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.046] GetProcessHeap () returned 0x560000 [0052.046] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ab8 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585178 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.047] GetProcessHeap () returned 0x560000 [0052.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2000 | out: hHeap=0x560000) returned 1 [0052.047] WriteFile (in: hFile=0x230, lpBuffer=0x5a3fc8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3fc8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.063] GetProcessHeap () returned 0x560000 [0052.063] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3fc8, Size=0x30) returned 0x5a3fc8 [0052.063] GetProcessHeap () returned 0x560000 [0052.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.063] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.063] GetProcessHeap () returned 0x560000 [0052.063] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7d50) returned 0x5a4d18 [0052.064] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x7d50, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x7d50, lpOverlapped=0x0) returned 1 [0052.064] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.064] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x7d50, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x7d50, lpOverlapped=0x0) returned 1 [0052.065] GetProcessHeap () returned 0x560000 [0052.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.066] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.066] WriteFile (in: hFile=0x230, lpBuffer=0x5a3fc8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3fc8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.067] CloseHandle (hObject=0x230) returned 1 [0052.068] GetProcessHeap () returned 0x560000 [0052.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d4b8 | out: hHeap=0x560000) returned 1 [0052.068] GetProcessHeap () returned 0x560000 [0052.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.068] GetProcessHeap () returned 0x560000 [0052.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19a0 | out: hHeap=0x560000) returned 1 [0052.068] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx" [0052.068] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx.badday" [0052.068] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\8j6ipmupifk9bp8nkpd.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\8j6ipmupifk9bp8nkpd.xlsx.badday"), dwFlags=0x1) returned 1 [0052.068] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\8j6IpMUpIfK9Bp8nkPD.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.068] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.069] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.069] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.069] GetProcessHeap () returned 0x560000 [0052.069] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0052.069] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9c7e60, ftCreationTime.dwHighDateTime=0x1d4ee67, ftLastAccessTime.dwLowDateTime=0xaee074a0, ftLastAccessTime.dwHighDateTime=0x1d4f602, ftLastWriteTime.dwLowDateTime=0xaee074a0, ftLastWriteTime.dwHighDateTime=0x1d4f602, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A5n7H.pptx", cAlternateFileName="A5N7H~1.PPT")) returned 1 [0052.069] lstrcmpiW (lpString1="A5n7H.pptx", lpString2=".") returned 1 [0052.069] lstrcmpiW (lpString1="A5n7H.pptx", lpString2="..") returned 1 [0052.069] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="A5n7H.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx") returned="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx" [0052.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="A5n7H.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.069] GetProcessHeap () returned 0x560000 [0052.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0052.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="A5n7H.pptx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A5n7H.pptx", lpUsedDefaultChar=0x0) returned 11 [0052.069] lstrlenA (lpString="A5n7H.pptx") returned 10 [0052.069] lstrlenA (lpString=".badday") returned 7 [0052.069] lstrlenA (lpString=".badday") returned 7 [0052.069] lstrlenA (lpString="A5n7H.pptx") returned 10 [0052.069] lstrcmpiA (lpString1="7H.pptx", lpString2=".badday") returned 1 [0052.069] lstrcmpiW (lpString1="A5n7H.pptx", lpString2="how_to_back_files.html") returned -1 [0052.069] lstrcmpiW (lpString1="A5n7H.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.069] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.069] lstrcmpiW (lpString1="A5n7H.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.069] GetProcessHeap () returned 0x560000 [0052.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d170 [0052.069] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a5n7h.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.069] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=31094) returned 1 [0052.070] GetProcessHeap () returned 0x560000 [0052.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.070] GetProcessHeap () returned 0x560000 [0052.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0052.070] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx") returned 36 [0052.070] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.070] GetProcessHeap () returned 0x560000 [0052.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.070] GetProcessHeap () returned 0x560000 [0052.070] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4000 [0052.070] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.070] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a16f8) returned 1 [0052.070] CryptGenRandom (in: hProv=0x5a16f8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.070] CryptReleaseContext (hProv=0x5a16f8, dwFlags=0x0) returned 1 [0052.071] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1890 [0052.071] lstrlenA (lpString="010001") returned 6 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584cf8 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584368 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586c90 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ab0 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.071] GetProcessHeap () returned 0x560000 [0052.071] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3d98 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5846c8 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ab0 | out: hHeap=0x560000) returned 1 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5846c8 | out: hHeap=0x560000) returned 1 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3c18 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.072] GetProcessHeap () returned 0x560000 [0052.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584758 [0052.072] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3c18 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586718 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584758 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.073] GetProcessHeap () returned 0x560000 [0052.073] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.074] GetProcessHeap () returned 0x560000 [0052.074] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.075] GetProcessHeap () returned 0x560000 [0052.075] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.075] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.076] GetProcessHeap () returned 0x560000 [0052.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.076] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d98 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0052.077] GetProcessHeap () returned 0x560000 [0052.077] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0052.078] GetProcessHeap () returned 0x560000 [0052.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.078] GetProcessHeap () returned 0x560000 [0052.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0052.078] GetProcessHeap () returned 0x560000 [0052.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.078] GetProcessHeap () returned 0x560000 [0052.078] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1890 | out: hHeap=0x560000) returned 1 [0052.078] WriteFile (in: hFile=0x230, lpBuffer=0x5a4000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4000*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.080] GetProcessHeap () returned 0x560000 [0052.080] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4000, Size=0x30) returned 0x5a4000 [0052.080] GetProcessHeap () returned 0x560000 [0052.080] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.080] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.080] GetProcessHeap () returned 0x560000 [0052.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7976) returned 0x5a4d18 [0052.081] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x7976, lpOverlapped=0x0) returned 1 [0052.082] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.082] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x7976, lpOverlapped=0x0) returned 1 [0052.083] GetProcessHeap () returned 0x560000 [0052.083] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.083] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.083] WriteFile (in: hFile=0x230, lpBuffer=0x5a4000*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4000*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.084] CloseHandle (hObject=0x230) returned 1 [0052.084] GetProcessHeap () returned 0x560000 [0052.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d170 | out: hHeap=0x560000) returned 1 [0052.084] GetProcessHeap () returned 0x560000 [0052.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.084] GetProcessHeap () returned 0x560000 [0052.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0052.085] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx") returned="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx" [0052.085] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx.badday" [0052.085] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a5n7h.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\a5n7h.pptx.badday"), dwFlags=0x1) returned 1 [0052.085] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\A5n7H.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.085] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.085] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.085] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.085] GetProcessHeap () returned 0x560000 [0052.085] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.085] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cca8e0, ftCreationTime.dwHighDateTime=0x1d5665d, ftLastAccessTime.dwLowDateTime=0xbc3fa1b0, ftLastAccessTime.dwHighDateTime=0x1d50ef9, ftLastWriteTime.dwLowDateTime=0xbc3fa1b0, ftLastWriteTime.dwHighDateTime=0x1d50ef9, nFileSizeHigh=0x0, nFileSizeLow=0x1415f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B8KLXich.docx", cAlternateFileName="B8KLXI~1.DOC")) returned 1 [0052.085] lstrcmpiW (lpString1="B8KLXich.docx", lpString2=".") returned 1 [0052.085] lstrcmpiW (lpString1="B8KLXich.docx", lpString2="..") returned 1 [0052.085] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="B8KLXich.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx") returned="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx" [0052.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B8KLXich.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.086] GetProcessHeap () returned 0x560000 [0052.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0052.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B8KLXich.docx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B8KLXich.docx", lpUsedDefaultChar=0x0) returned 14 [0052.086] lstrlenA (lpString="B8KLXich.docx") returned 13 [0052.086] lstrlenA (lpString=".badday") returned 7 [0052.086] lstrlenA (lpString=".badday") returned 7 [0052.086] lstrlenA (lpString="B8KLXich.docx") returned 13 [0052.086] lstrcmpiA (lpString1="ch.docx", lpString2=".badday") returned 1 [0052.086] lstrcmpiW (lpString1="B8KLXich.docx", lpString2="how_to_back_files.html") returned -1 [0052.086] lstrcmpiW (lpString1="B8KLXich.docx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.086] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.086] lstrcmpiW (lpString1="B8KLXich.docx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.086] GetProcessHeap () returned 0x560000 [0052.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0052.086] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx" (normalized: "c:\\users\\fd1hvy\\documents\\b8klxich.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.086] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=82271) returned 1 [0052.086] GetProcessHeap () returned 0x560000 [0052.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.086] GetProcessHeap () returned 0x560000 [0052.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0052.086] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx") returned 39 [0052.086] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.086] GetProcessHeap () returned 0x560000 [0052.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.086] GetProcessHeap () returned 0x560000 [0052.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x5a4038 [0052.087] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.087] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a2330) returned 1 [0052.087] CryptGenRandom (in: hProv=0x5a2330, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.087] CryptReleaseContext (hProv=0x5a2330, dwFlags=0x0) returned 1 [0052.087] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.087] GetProcessHeap () returned 0x560000 [0052.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0052.087] lstrlenA (lpString="010001") returned 6 [0052.087] GetProcessHeap () returned 0x560000 [0052.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0052.087] GetProcessHeap () returned 0x560000 [0052.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0052.087] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584bd8 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843f8 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0052.088] GetProcessHeap () returned 0x560000 [0052.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3f18 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584878 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584878 | out: hHeap=0x560000) returned 1 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a3f48 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584758 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3f48 | out: hHeap=0x560000) returned 1 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587208 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584758 | out: hHeap=0x560000) returned 1 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.089] GetProcessHeap () returned 0x560000 [0052.089] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.090] GetProcessHeap () returned 0x560000 [0052.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.091] GetProcessHeap () returned 0x560000 [0052.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.092] GetProcessHeap () returned 0x560000 [0052.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.093] GetProcessHeap () returned 0x560000 [0052.093] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.093] GetProcessHeap () returned 0x560000 [0052.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587208 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3f18 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843f8 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584bd8 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.094] GetProcessHeap () returned 0x560000 [0052.094] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0052.094] WriteFile (in: hFile=0x230, lpBuffer=0x5a4038*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4038*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0052.097] GetProcessHeap () returned 0x560000 [0052.097] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4038, Size=0x30) returned 0x5a4038 [0052.097] GetProcessHeap () returned 0x560000 [0052.097] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.097] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.097] GetProcessHeap () returned 0x560000 [0052.097] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14160) returned 0x5a4d18 [0052.098] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x14160, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x14160, lpOverlapped=0x0) returned 1 [0052.099] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.099] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x14160, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x14160, lpOverlapped=0x0) returned 1 [0052.100] GetProcessHeap () returned 0x560000 [0052.100] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.102] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.102] WriteFile (in: hFile=0x230, lpBuffer=0x5a4038*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4038*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.103] CloseHandle (hObject=0x230) returned 1 [0052.103] GetProcessHeap () returned 0x560000 [0052.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0052.103] GetProcessHeap () returned 0x560000 [0052.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.103] GetProcessHeap () returned 0x560000 [0052.103] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0052.103] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx") returned="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx" [0052.103] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx.badday") returned="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx.badday" [0052.103] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx" (normalized: "c:\\users\\fd1hvy\\documents\\b8klxich.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\b8klxich.docx.badday"), dwFlags=0x1) returned 1 [0052.104] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\B8KLXich.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.104] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.104] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.104] GetProcessHeap () returned 0x560000 [0052.104] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.104] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0052.104] lstrcmpiW (lpString1="Database1.accdb", lpString2=".") returned 1 [0052.104] lstrcmpiW (lpString1="Database1.accdb", lpString2="..") returned 1 [0052.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Database1.accdb" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0052.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database1.accdb", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.104] GetProcessHeap () returned 0x560000 [0052.104] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0052.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database1.accdb", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database1.accdb", lpUsedDefaultChar=0x0) returned 16 [0052.105] lstrlenA (lpString="Database1.accdb") returned 15 [0052.105] lstrlenA (lpString=".badday") returned 7 [0052.105] lstrlenA (lpString=".badday") returned 7 [0052.105] lstrlenA (lpString="Database1.accdb") returned 15 [0052.105] lstrcmpiA (lpString1="1.accdb", lpString2=".badday") returned 1 [0052.105] lstrcmpiW (lpString1="Database1.accdb", lpString2="how_to_back_files.html") returned -1 [0052.105] lstrcmpiW (lpString1="Database1.accdb", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.105] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.105] lstrcmpiW (lpString1="Database1.accdb", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.105] GetProcessHeap () returned 0x560000 [0052.105] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0052.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.108] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=348160) returned 1 [0052.108] GetProcessHeap () returned 0x560000 [0052.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.108] GetProcessHeap () returned 0x560000 [0052.108] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2198 [0052.109] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned 41 [0052.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.109] GetProcessHeap () returned 0x560000 [0052.109] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.109] GetProcessHeap () returned 0x560000 [0052.109] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a3b88 [0052.109] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.109] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1de0) returned 1 [0052.109] CryptGenRandom (in: hProv=0x5a1de0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.109] CryptReleaseContext (hProv=0x5a1de0, dwFlags=0x0) returned 1 [0052.109] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.109] GetProcessHeap () returned 0x560000 [0052.109] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1808 [0052.109] lstrlenA (lpString="010001") returned 6 [0052.109] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a16f8 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584cf8 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a16f8 | out: hHeap=0x560000) returned 1 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f38 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586718 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586b78 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1918 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586fd8 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589bf0 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584368 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1918 | out: hHeap=0x560000) returned 1 [0052.110] GetProcessHeap () returned 0x560000 [0052.110] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e18 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5850e8 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e18 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850e8 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.111] GetProcessHeap () returned 0x560000 [0052.111] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.111] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.112] GetProcessHeap () returned 0x560000 [0052.112] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.112] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.113] GetProcessHeap () returned 0x560000 [0052.113] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.114] GetProcessHeap () returned 0x560000 [0052.114] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0052.115] GetProcessHeap () returned 0x560000 [0052.115] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586fd8 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589bf0 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f38 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586718 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.116] GetProcessHeap () returned 0x560000 [0052.116] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1808 | out: hHeap=0x560000) returned 1 [0052.116] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b88*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3b88*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.121] GetProcessHeap () returned 0x560000 [0052.121] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3b88, Size=0x30) returned 0x5a3b88 [0052.121] GetProcessHeap () returned 0x560000 [0052.121] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.122] GetProcessHeap () returned 0x560000 [0052.122] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x55000) returned 0x5a4d18 [0052.128] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x55000, lpOverlapped=0x0) returned 1 [0052.134] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.134] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x55000, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x55000, lpOverlapped=0x0) returned 1 [0052.148] GetProcessHeap () returned 0x560000 [0052.149] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.149] WriteFile (in: hFile=0x230, lpBuffer=0x5a3b88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3b88*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.149] CloseHandle (hObject=0x230) returned 1 [0052.150] GetProcessHeap () returned 0x560000 [0052.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0052.150] GetProcessHeap () returned 0x560000 [0052.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.150] GetProcessHeap () returned 0x560000 [0052.150] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2198 | out: hHeap=0x560000) returned 1 [0052.150] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0052.150] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.badday") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.badday" [0052.150] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.badday" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.badday"), dwFlags=0x1) returned 1 [0052.152] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.152] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.152] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.152] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.153] GetProcessHeap () returned 0x560000 [0052.153] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.153] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0052.153] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0052.153] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0052.153] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini" [0052.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.153] GetProcessHeap () returned 0x560000 [0052.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0052.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0052.153] lstrlenA (lpString="desktop.ini") returned 11 [0052.153] lstrlenA (lpString=".badday") returned 7 [0052.153] lstrlenA (lpString=".badday") returned 7 [0052.153] lstrlenA (lpString="desktop.ini") returned 11 [0052.153] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0052.153] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0052.153] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.153] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.153] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.153] GetProcessHeap () returned 0x560000 [0052.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0052.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.153] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=402) returned 1 [0052.153] GetProcessHeap () returned 0x560000 [0052.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.154] GetProcessHeap () returned 0x560000 [0052.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0052.154] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned 37 [0052.154] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.154] GetProcessHeap () returned 0x560000 [0052.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.154] GetProcessHeap () returned 0x560000 [0052.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38e) returned 0x58c2c0 [0052.154] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.154] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1918) returned 1 [0052.154] CryptGenRandom (in: hProv=0x5a1918, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.154] CryptReleaseContext (hProv=0x5a1918, dwFlags=0x0) returned 1 [0052.154] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.154] GetProcessHeap () returned 0x560000 [0052.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2110 [0052.155] lstrlenA (lpString="010001") returned 6 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1bc0 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584a28 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bc0 | out: hHeap=0x560000) returned 1 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5850e8 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586b78 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586830 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587438 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2088 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586948 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a42c8 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584f38 [0052.155] GetProcessHeap () returned 0x560000 [0052.155] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2088 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586a60 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584f38 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4178 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584d88 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4178 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586600 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d88 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.156] GetProcessHeap () returned 0x560000 [0052.156] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.156] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.157] GetProcessHeap () returned 0x560000 [0052.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.157] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.158] GetProcessHeap () returned 0x560000 [0052.158] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.159] GetProcessHeap () returned 0x560000 [0052.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.160] GetProcessHeap () returned 0x560000 [0052.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.160] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a42c8 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850e8 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b78 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a28 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.161] GetProcessHeap () returned 0x560000 [0052.161] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2110 | out: hHeap=0x560000) returned 1 [0052.161] WriteFile (in: hFile=0x230, lpBuffer=0x58c2c0*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58c2c0*, lpNumberOfBytesWritten=0x24ad864*=0x38e, lpOverlapped=0x0) returned 1 [0052.164] GetProcessHeap () returned 0x560000 [0052.164] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58c2c0, Size=0x30) returned 0x582f38 [0052.164] GetProcessHeap () returned 0x560000 [0052.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.164] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.164] GetProcessHeap () returned 0x560000 [0052.164] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a0) returned 0x5703a0 [0052.164] ReadFile (in: hFile=0x230, lpBuffer=0x5703a0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesRead=0x24ad7e8*=0x1a0, lpOverlapped=0x0) returned 1 [0052.165] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.165] WriteFile (in: hFile=0x230, lpBuffer=0x5703a0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5703a0*, lpNumberOfBytesWritten=0x24ad7e4*=0x1a0, lpOverlapped=0x0) returned 1 [0052.165] GetProcessHeap () returned 0x560000 [0052.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5703a0 | out: hHeap=0x560000) returned 1 [0052.166] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.166] WriteFile (in: hFile=0x230, lpBuffer=0x582f38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x582f38*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.167] CloseHandle (hObject=0x230) returned 1 [0052.168] GetProcessHeap () returned 0x560000 [0052.168] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0052.168] GetProcessHeap () returned 0x560000 [0052.168] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.168] GetProcessHeap () returned 0x560000 [0052.168] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0052.168] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini" [0052.168] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini.badday" [0052.168] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0052.168] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.168] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.168] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.168] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.169] GetProcessHeap () returned 0x560000 [0052.169] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.169] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a3d330, ftCreationTime.dwHighDateTime=0x1d51b46, ftLastAccessTime.dwLowDateTime=0xd70d6ae0, ftLastAccessTime.dwHighDateTime=0x1d55c1f, ftLastWriteTime.dwLowDateTime=0xd70d6ae0, ftLastWriteTime.dwHighDateTime=0x1d55c1f, nFileSizeHigh=0x0, nFileSizeLow=0x162ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DlofsU.pptx", cAlternateFileName="DLOFSU~1.PPT")) returned 1 [0052.169] lstrcmpiW (lpString1="DlofsU.pptx", lpString2=".") returned 1 [0052.169] lstrcmpiW (lpString1="DlofsU.pptx", lpString2="..") returned 1 [0052.169] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="DlofsU.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx") returned="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx" [0052.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DlofsU.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.169] GetProcessHeap () returned 0x560000 [0052.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0052.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DlofsU.pptx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DlofsU.pptx", lpUsedDefaultChar=0x0) returned 12 [0052.169] lstrlenA (lpString="DlofsU.pptx") returned 11 [0052.169] lstrlenA (lpString=".badday") returned 7 [0052.169] lstrlenA (lpString=".badday") returned 7 [0052.169] lstrlenA (lpString="DlofsU.pptx") returned 11 [0052.169] lstrcmpiA (lpString1="sU.pptx", lpString2=".badday") returned 1 [0052.169] lstrcmpiW (lpString1="DlofsU.pptx", lpString2="how_to_back_files.html") returned -1 [0052.169] lstrcmpiW (lpString1="DlofsU.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.169] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.169] lstrcmpiW (lpString1="DlofsU.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.169] GetProcessHeap () returned 0x560000 [0052.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0052.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\dlofsu.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.169] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=90810) returned 1 [0052.169] GetProcessHeap () returned 0x560000 [0052.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.170] GetProcessHeap () returned 0x560000 [0052.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1ef0 [0052.170] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx") returned 37 [0052.170] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.170] GetProcessHeap () returned 0x560000 [0052.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.170] GetProcessHeap () returned 0x560000 [0052.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a3bc0 [0052.170] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.170] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a1808) returned 1 [0052.170] CryptGenRandom (in: hProv=0x5a1808, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.170] CryptReleaseContext (hProv=0x5a1808, dwFlags=0x0) returned 1 [0052.170] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.170] GetProcessHeap () returned 0x560000 [0052.170] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a14d8 [0052.171] lstrlenA (lpString="010001") returned 6 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1780 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585058 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1780 | out: hHeap=0x560000) returned 1 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5847e8 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586a60 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x587320 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x587438 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a42f8 [0052.171] GetProcessHeap () returned 0x560000 [0052.171] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5843f8 [0052.171] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586c90 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843f8 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4220 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x584cf8 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4220 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.172] GetProcessHeap () returned 0x560000 [0052.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.173] GetProcessHeap () returned 0x560000 [0052.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.173] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.174] GetProcessHeap () returned 0x560000 [0052.174] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.175] GetProcessHeap () returned 0x560000 [0052.175] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.176] GetProcessHeap () returned 0x560000 [0052.176] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587320 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587438 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a42f8 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847e8 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a60 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585058 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.177] GetProcessHeap () returned 0x560000 [0052.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a14d8 | out: hHeap=0x560000) returned 1 [0052.177] WriteFile (in: hFile=0x230, lpBuffer=0x5a3bc0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3bc0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.179] GetProcessHeap () returned 0x560000 [0052.179] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3bc0, Size=0x30) returned 0x5a3bc0 [0052.179] GetProcessHeap () returned 0x560000 [0052.179] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.180] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.180] GetProcessHeap () returned 0x560000 [0052.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x162ba) returned 0x5a4d18 [0052.180] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x162ba, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x162ba, lpOverlapped=0x0) returned 1 [0052.181] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.181] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x162ba, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x162ba, lpOverlapped=0x0) returned 1 [0052.183] GetProcessHeap () returned 0x560000 [0052.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.183] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.183] WriteFile (in: hFile=0x230, lpBuffer=0x5a3bc0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3bc0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.184] CloseHandle (hObject=0x230) returned 1 [0052.184] GetProcessHeap () returned 0x560000 [0052.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0052.184] GetProcessHeap () returned 0x560000 [0052.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.184] GetProcessHeap () returned 0x560000 [0052.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ef0 | out: hHeap=0x560000) returned 1 [0052.184] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx") returned="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx" [0052.184] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx.badday" [0052.184] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\dlofsu.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\dlofsu.pptx.badday"), dwFlags=0x1) returned 1 [0052.185] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\DlofsU.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.185] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.185] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.185] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.185] GetProcessHeap () returned 0x560000 [0052.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.185] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23fcf410, ftCreationTime.dwHighDateTime=0x1d52610, ftLastAccessTime.dwLowDateTime=0x70d9a760, ftLastAccessTime.dwHighDateTime=0x1d54fcd, ftLastWriteTime.dwLowDateTime=0x70d9a760, ftLastWriteTime.dwHighDateTime=0x1d54fcd, nFileSizeHigh=0x0, nFileSizeLow=0x9c5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h13aA.xlsx", cAlternateFileName="H13AA~1.XLS")) returned 1 [0052.185] lstrcmpiW (lpString1="h13aA.xlsx", lpString2=".") returned 1 [0052.185] lstrcmpiW (lpString1="h13aA.xlsx", lpString2="..") returned 1 [0052.185] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="h13aA.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx" [0052.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h13aA.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.185] GetProcessHeap () returned 0x560000 [0052.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0052.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h13aA.xlsx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h13aA.xlsx", lpUsedDefaultChar=0x0) returned 11 [0052.185] lstrlenA (lpString="h13aA.xlsx") returned 10 [0052.185] lstrlenA (lpString=".badday") returned 7 [0052.185] lstrlenA (lpString=".badday") returned 7 [0052.185] lstrlenA (lpString="h13aA.xlsx") returned 10 [0052.185] lstrcmpiA (lpString1="aA.xlsx", lpString2=".badday") returned 1 [0052.185] lstrcmpiW (lpString1="h13aA.xlsx", lpString2="how_to_back_files.html") returned -1 [0052.186] lstrcmpiW (lpString1="h13aA.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.186] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.186] lstrcmpiW (lpString1="h13aA.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.186] GetProcessHeap () returned 0x560000 [0052.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0052.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\h13aa.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.186] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=40031) returned 1 [0052.186] GetProcessHeap () returned 0x560000 [0052.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.186] GetProcessHeap () returned 0x560000 [0052.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a22a8 [0052.186] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx") returned 36 [0052.186] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.186] GetProcessHeap () returned 0x560000 [0052.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.186] GetProcessHeap () returned 0x560000 [0052.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x381) returned 0x5a3bf8 [0052.186] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.186] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5a14d8) returned 1 [0052.187] CryptGenRandom (in: hProv=0x5a14d8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.187] CryptReleaseContext (hProv=0x5a14d8, dwFlags=0x0) returned 1 [0052.187] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1a28 [0052.187] lstrlenA (lpString="010001") returned 6 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a1f78 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584d88 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f78 | out: hHeap=0x560000) returned 1 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x584998 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x586830 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586ec0 [0052.187] GetProcessHeap () returned 0x560000 [0052.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5870f0 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5a2330 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x586c90 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4460 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x585298 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2330 | out: hHeap=0x560000) returned 1 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586948 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585298 | out: hHeap=0x560000) returned 1 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4400 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5847e8 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4400 | out: hHeap=0x560000) returned 1 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x586da8 [0052.188] GetProcessHeap () returned 0x560000 [0052.188] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847e8 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.189] GetProcessHeap () returned 0x560000 [0052.189] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0052.190] GetProcessHeap () returned 0x560000 [0052.190] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.191] GetProcessHeap () returned 0x560000 [0052.191] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.192] GetProcessHeap () returned 0x560000 [0052.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870f0 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586948 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c90 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586da8 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584998 | out: hHeap=0x560000) returned 1 [0052.193] GetProcessHeap () returned 0x560000 [0052.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586830 | out: hHeap=0x560000) returned 1 [0052.194] GetProcessHeap () returned 0x560000 [0052.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d88 | out: hHeap=0x560000) returned 1 [0052.194] GetProcessHeap () returned 0x560000 [0052.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ec0 | out: hHeap=0x560000) returned 1 [0052.194] GetProcessHeap () returned 0x560000 [0052.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.194] GetProcessHeap () returned 0x560000 [0052.194] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1a28 | out: hHeap=0x560000) returned 1 [0052.194] WriteFile (in: hFile=0x230, lpBuffer=0x5a3bf8*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3bf8*, lpNumberOfBytesWritten=0x24ad864*=0x381, lpOverlapped=0x0) returned 1 [0052.196] GetProcessHeap () returned 0x560000 [0052.196] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3bf8, Size=0x30) returned 0x5a3bf8 [0052.196] GetProcessHeap () returned 0x560000 [0052.196] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.196] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.196] GetProcessHeap () returned 0x560000 [0052.196] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9c60) returned 0x5a4d18 [0052.196] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x9c60, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x9c60, lpOverlapped=0x0) returned 1 [0052.197] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.197] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x9c60, lpOverlapped=0x0) returned 1 [0052.248] GetProcessHeap () returned 0x560000 [0052.248] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.250] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.250] WriteFile (in: hFile=0x230, lpBuffer=0x5a3bf8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a3bf8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.252] CloseHandle (hObject=0x230) returned 1 [0052.252] GetProcessHeap () returned 0x560000 [0052.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0052.252] GetProcessHeap () returned 0x560000 [0052.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.252] GetProcessHeap () returned 0x560000 [0052.252] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a22a8 | out: hHeap=0x560000) returned 1 [0052.252] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx" [0052.252] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx.badday" [0052.252] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\h13aa.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\h13aa.xlsx.badday"), dwFlags=0x1) returned 1 [0052.253] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\h13aA.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.253] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.253] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.253] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.253] GetProcessHeap () returned 0x560000 [0052.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.253] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0052.253] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0052.253] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0052.253] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0052.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.253] GetProcessHeap () returned 0x560000 [0052.253] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0052.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Music", lpUsedDefaultChar=0x0) returned 9 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.254] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.255] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0052.255] GetProcessHeap () returned 0x560000 [0052.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a138 [0052.255] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned 35 [0052.255] GetProcessHeap () returned 0x560000 [0052.255] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x48) returned 0x585b40 [0052.255] lstrcpyW (in: lpString1=0x585b40, lpString2="C:\\Users\\FD1HVy\\Documents\\My Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0052.255] GetProcessHeap () returned 0x560000 [0052.255] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.255] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0052.255] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0052.255] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0052.255] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0052.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.255] GetProcessHeap () returned 0x560000 [0052.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0052.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Pictures", lpUsedDefaultChar=0x0) returned 12 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.257] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0052.257] GetProcessHeap () returned 0x560000 [0052.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a088 [0052.257] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned 38 [0052.257] GetProcessHeap () returned 0x560000 [0052.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4e) returned 0x58e418 [0052.257] lstrcpyW (in: lpString1=0x58e418, lpString2="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0052.257] GetProcessHeap () returned 0x560000 [0052.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.257] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0052.257] lstrcmpiW (lpString1="My Shapes", lpString2=".") returned 1 [0052.257] lstrcmpiW (lpString1="My Shapes", lpString2="..") returned 1 [0052.257] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0052.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Shapes", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.257] GetProcessHeap () returned 0x560000 [0052.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0052.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Shapes", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Shapes", lpUsedDefaultChar=0x0) returned 10 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.258] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.259] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.259] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0052.259] GetProcessHeap () returned 0x560000 [0052.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a148 [0052.259] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned 36 [0052.259] GetProcessHeap () returned 0x560000 [0052.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4a) returned 0x58e2b8 [0052.259] lstrcpyW (in: lpString1=0x58e2b8, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0052.259] GetProcessHeap () returned 0x560000 [0052.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.259] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0052.260] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0052.260] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0052.260] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0052.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.260] GetProcessHeap () returned 0x560000 [0052.260] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0052.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Videos", lpUsedDefaultChar=0x0) returned 10 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.260] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.261] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.261] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0052.261] GetProcessHeap () returned 0x560000 [0052.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a118 [0052.261] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned 36 [0052.261] GetProcessHeap () returned 0x560000 [0052.261] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4a) returned 0x58e680 [0052.261] lstrcpyW (in: lpString1=0x58e680, lpString2="C:\\Users\\FD1HVy\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0052.261] GetProcessHeap () returned 0x560000 [0052.261] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.261] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae527fb0, ftCreationTime.dwHighDateTime=0x1d4d217, ftLastAccessTime.dwLowDateTime=0x739d31f0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0x739d31f0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x10c3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O4A3gC5ROCsP3AKxq7D.pptx", cAlternateFileName="O4A3GC~1.PPT")) returned 1 [0052.262] lstrcmpiW (lpString1="O4A3gC5ROCsP3AKxq7D.pptx", lpString2=".") returned 1 [0052.262] lstrcmpiW (lpString1="O4A3gC5ROCsP3AKxq7D.pptx", lpString2="..") returned 1 [0052.262] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="O4A3gC5ROCsP3AKxq7D.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx") returned="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx" [0052.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O4A3gC5ROCsP3AKxq7D.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0052.262] GetProcessHeap () returned 0x560000 [0052.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d530 [0052.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O4A3gC5ROCsP3AKxq7D.pptx", cchWideChar=-1, lpMultiByteStr=0x57d530, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="O4A3gC5ROCsP3AKxq7D.pptx", lpUsedDefaultChar=0x0) returned 25 [0052.262] lstrlenA (lpString="O4A3gC5ROCsP3AKxq7D.pptx") returned 24 [0052.262] lstrlenA (lpString=".badday") returned 7 [0052.262] lstrlenA (lpString=".badday") returned 7 [0052.262] lstrlenA (lpString="O4A3gC5ROCsP3AKxq7D.pptx") returned 24 [0052.262] lstrcmpiA (lpString1="7D.pptx", lpString2=".badday") returned 1 [0052.262] lstrcmpiW (lpString1="O4A3gC5ROCsP3AKxq7D.pptx", lpString2="how_to_back_files.html") returned 1 [0052.262] lstrcmpiW (lpString1="O4A3gC5ROCsP3AKxq7D.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.262] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.262] lstrcmpiW (lpString1="O4A3gC5ROCsP3AKxq7D.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.262] GetProcessHeap () returned 0x560000 [0052.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0052.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\o4a3gc5rocsp3akxq7d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.262] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=68668) returned 1 [0052.262] GetProcessHeap () returned 0x560000 [0052.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.262] GetProcessHeap () returned 0x560000 [0052.262] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5849c8 [0052.262] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx") returned 50 [0052.262] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.263] GetProcessHeap () returned 0x560000 [0052.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.263] GetProcessHeap () returned 0x560000 [0052.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x384) returned 0x5a4478 [0052.263] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.263] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584e08) returned 1 [0052.263] CryptGenRandom (in: hProv=0x584e08, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.263] CryptReleaseContext (hProv=0x584e08, dwFlags=0x0) returned 1 [0052.263] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.263] GetProcessHeap () returned 0x560000 [0052.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584610 [0052.263] lstrlenA (lpString="010001") returned 6 [0052.263] GetProcessHeap () returned 0x560000 [0052.263] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584d80 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584d80 | out: hHeap=0x560000) returned 1 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59f750 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a168 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fef8 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f868 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59fde0 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587260 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fbb0 [0052.264] GetProcessHeap () returned 0x560000 [0052.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4100 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5872f0 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4100 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fcc8 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.265] GetProcessHeap () returned 0x560000 [0052.265] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.266] GetProcessHeap () returned 0x560000 [0052.266] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.267] GetProcessHeap () returned 0x560000 [0052.267] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.268] GetProcessHeap () returned 0x560000 [0052.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f868 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbb0 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.269] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fde0 | out: hHeap=0x560000) returned 1 [0052.269] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fcc8 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f750 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.270] GetProcessHeap () returned 0x560000 [0052.270] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584610 | out: hHeap=0x560000) returned 1 [0052.270] WriteFile (in: hFile=0x230, lpBuffer=0x5a4478*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4478*, lpNumberOfBytesWritten=0x24ad864*=0x384, lpOverlapped=0x0) returned 1 [0052.273] GetProcessHeap () returned 0x560000 [0052.273] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4478, Size=0x30) returned 0x5a4478 [0052.273] GetProcessHeap () returned 0x560000 [0052.273] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.273] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.273] GetProcessHeap () returned 0x560000 [0052.273] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10c40) returned 0x5a4d18 [0052.275] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x10c40, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x10c40, lpOverlapped=0x0) returned 1 [0052.276] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.276] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x10c40, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x10c40, lpOverlapped=0x0) returned 1 [0052.277] GetProcessHeap () returned 0x560000 [0052.277] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.278] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.278] WriteFile (in: hFile=0x230, lpBuffer=0x5a4478*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4478*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.280] CloseHandle (hObject=0x230) returned 1 [0052.281] GetProcessHeap () returned 0x560000 [0052.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0052.281] GetProcessHeap () returned 0x560000 [0052.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.281] GetProcessHeap () returned 0x560000 [0052.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5849c8 | out: hHeap=0x560000) returned 1 [0052.281] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx") returned="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx" [0052.281] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx.badday" [0052.281] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\o4a3gc5rocsp3akxq7d.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\o4a3gc5rocsp3akxq7d.pptx.badday"), dwFlags=0x1) returned 1 [0052.282] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\O4A3gC5ROCsP3AKxq7D.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.282] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.282] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.282] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.282] GetProcessHeap () returned 0x560000 [0052.282] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0052.282] lstrcmpiW (lpString1="Outlook Files", lpString2=".") returned 1 [0052.282] lstrcmpiW (lpString1="Outlook Files", lpString2="..") returned 1 [0052.282] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0052.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Outlook Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.282] GetProcessHeap () returned 0x560000 [0052.282] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0052.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Outlook Files", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook Files", lpUsedDefaultChar=0x0) returned 14 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.282] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.283] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0052.284] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.284] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.284] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0052.284] GetProcessHeap () returned 0x560000 [0052.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a058 [0052.284] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned 40 [0052.284] GetProcessHeap () returned 0x560000 [0052.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x52) returned 0x589de0 [0052.284] lstrcpyW (in: lpString1=0x589de0, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0052.284] GetProcessHeap () returned 0x560000 [0052.284] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83fb50, ftCreationTime.dwHighDateTime=0x1d5032f, ftLastAccessTime.dwLowDateTime=0x77256890, ftLastAccessTime.dwHighDateTime=0x1d50bc9, ftLastWriteTime.dwLowDateTime=0x77256890, ftLastWriteTime.dwHighDateTime=0x1d50bc9, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QzRXbC.xlsx", cAlternateFileName="QZRXBC~1.XLS")) returned 1 [0052.284] lstrcmpiW (lpString1="QzRXbC.xlsx", lpString2=".") returned 1 [0052.284] lstrcmpiW (lpString1="QzRXbC.xlsx", lpString2="..") returned 1 [0052.284] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="QzRXbC.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx" [0052.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QzRXbC.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.284] GetProcessHeap () returned 0x560000 [0052.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0052.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QzRXbC.xlsx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QzRXbC.xlsx", lpUsedDefaultChar=0x0) returned 12 [0052.284] lstrlenA (lpString="QzRXbC.xlsx") returned 11 [0052.284] lstrlenA (lpString=".badday") returned 7 [0052.284] lstrlenA (lpString=".badday") returned 7 [0052.284] lstrlenA (lpString="QzRXbC.xlsx") returned 11 [0052.284] lstrcmpiA (lpString1="bC.xlsx", lpString2=".badday") returned 1 [0052.284] lstrcmpiW (lpString1="QzRXbC.xlsx", lpString2="how_to_back_files.html") returned 1 [0052.284] lstrcmpiW (lpString1="QzRXbC.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.284] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.284] lstrcmpiW (lpString1="QzRXbC.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.284] GetProcessHeap () returned 0x560000 [0052.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d530 [0052.285] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\qzrxbc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.285] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=3754) returned 1 [0052.285] GetProcessHeap () returned 0x560000 [0052.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.285] GetProcessHeap () returned 0x560000 [0052.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584cf8 [0052.285] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx") returned 37 [0052.285] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.285] GetProcessHeap () returned 0x560000 [0052.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.285] GetProcessHeap () returned 0x560000 [0052.285] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x386) returned 0x5a44b0 [0052.285] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.285] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584698) returned 1 [0052.286] CryptGenRandom (in: hProv=0x584698, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.286] CryptReleaseContext (hProv=0x584698, dwFlags=0x0) returned 1 [0052.286] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584500 [0052.286] lstrlenA (lpString="010001") returned 6 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e90 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59f408 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0240 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fef8 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584610 [0052.286] GetProcessHeap () returned 0x560000 [0052.286] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59f980 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a41f0 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584610 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f520 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4298 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587260 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4298 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0128 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587260 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.287] GetProcessHeap () returned 0x560000 [0052.287] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.288] GetProcessHeap () returned 0x560000 [0052.288] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.289] GetProcessHeap () returned 0x560000 [0052.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.290] GetProcessHeap () returned 0x560000 [0052.290] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.290] GetProcessHeap () returned 0x560000 [0052.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.291] GetProcessHeap () returned 0x560000 [0052.291] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f520 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f980 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0128 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a41f0 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.292] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0052.292] GetProcessHeap () returned 0x560000 [0052.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0052.293] GetProcessHeap () returned 0x560000 [0052.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0052.293] GetProcessHeap () returned 0x560000 [0052.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0240 | out: hHeap=0x560000) returned 1 [0052.293] GetProcessHeap () returned 0x560000 [0052.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.293] GetProcessHeap () returned 0x560000 [0052.293] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0052.293] WriteFile (in: hFile=0x230, lpBuffer=0x5a44b0*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a44b0*, lpNumberOfBytesWritten=0x24ad864*=0x386, lpOverlapped=0x0) returned 1 [0052.298] GetProcessHeap () returned 0x560000 [0052.298] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a44b0, Size=0x30) returned 0x5a44b0 [0052.298] GetProcessHeap () returned 0x560000 [0052.298] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.298] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.298] GetProcessHeap () returned 0x560000 [0052.298] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xeb0) returned 0x5a4d18 [0052.299] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0xeb0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0xeb0, lpOverlapped=0x0) returned 1 [0052.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.299] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0xeb0, lpOverlapped=0x0) returned 1 [0052.300] GetProcessHeap () returned 0x560000 [0052.300] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.300] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.300] WriteFile (in: hFile=0x230, lpBuffer=0x5a44b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a44b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.301] CloseHandle (hObject=0x230) returned 1 [0052.302] GetProcessHeap () returned 0x560000 [0052.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0052.302] GetProcessHeap () returned 0x560000 [0052.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.302] GetProcessHeap () returned 0x560000 [0052.302] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.302] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx" [0052.302] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx.badday" [0052.302] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\qzrxbc.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\qzrxbc.xlsx.badday"), dwFlags=0x1) returned 1 [0052.302] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\QzRXbC.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.302] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.302] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.302] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.303] GetProcessHeap () returned 0x560000 [0052.303] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.303] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46105b70, ftCreationTime.dwHighDateTime=0x1d571a4, ftLastAccessTime.dwLowDateTime=0x816721a0, ftLastAccessTime.dwHighDateTime=0x1d4f17e, ftLastWriteTime.dwLowDateTime=0x816721a0, ftLastWriteTime.dwHighDateTime=0x1d4f17e, nFileSizeHigh=0x0, nFileSizeLow=0x5e67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rACpV0.docx", cAlternateFileName="RACPV0~1.DOC")) returned 1 [0052.303] lstrcmpiW (lpString1="rACpV0.docx", lpString2=".") returned 1 [0052.303] lstrcmpiW (lpString1="rACpV0.docx", lpString2="..") returned 1 [0052.303] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="rACpV0.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx") returned="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx" [0052.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rACpV0.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.303] GetProcessHeap () returned 0x560000 [0052.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0052.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rACpV0.docx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rACpV0.docx", lpUsedDefaultChar=0x0) returned 12 [0052.303] lstrlenA (lpString="rACpV0.docx") returned 11 [0052.303] lstrlenA (lpString=".badday") returned 7 [0052.303] lstrlenA (lpString=".badday") returned 7 [0052.303] lstrlenA (lpString="rACpV0.docx") returned 11 [0052.303] lstrcmpiA (lpString1="V0.docx", lpString2=".badday") returned 1 [0052.303] lstrcmpiW (lpString1="rACpV0.docx", lpString2="how_to_back_files.html") returned 1 [0052.303] lstrcmpiW (lpString1="rACpV0.docx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.303] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.303] lstrcmpiW (lpString1="rACpV0.docx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.303] GetProcessHeap () returned 0x560000 [0052.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d2d8 [0052.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\racpv0.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.303] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=24167) returned 1 [0052.303] GetProcessHeap () returned 0x560000 [0052.303] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.304] GetProcessHeap () returned 0x560000 [0052.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5847a8 [0052.304] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx") returned 37 [0052.304] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.304] GetProcessHeap () returned 0x560000 [0052.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.304] GetProcessHeap () returned 0x560000 [0052.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58c668 [0052.304] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.304] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584610) returned 1 [0052.304] CryptGenRandom (in: hProv=0x584610, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.304] CryptReleaseContext (hProv=0x584610, dwFlags=0x0) returned 1 [0052.304] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.304] GetProcessHeap () returned 0x560000 [0052.304] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584500 [0052.304] lstrlenA (lpString="010001") returned 6 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585138 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587140 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585138 | out: hHeap=0x560000) returned 1 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59f980 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fa98 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fef8 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584be8 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59f750 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4118 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586ba0 [0052.305] GetProcessHeap () returned 0x560000 [0052.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584be8 | out: hHeap=0x560000) returned 1 [0052.305] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f520 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ba0 | out: hHeap=0x560000) returned 1 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4220 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x587530 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4220 | out: hHeap=0x560000) returned 1 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fbb0 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.306] GetProcessHeap () returned 0x560000 [0052.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.306] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.307] GetProcessHeap () returned 0x560000 [0052.307] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.308] GetProcessHeap () returned 0x560000 [0052.308] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.309] GetProcessHeap () returned 0x560000 [0052.309] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.309] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.310] GetProcessHeap () returned 0x560000 [0052.310] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.310] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f520 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f750 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbb0 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4118 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f980 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587140 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa98 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.311] GetProcessHeap () returned 0x560000 [0052.311] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0052.311] WriteFile (in: hFile=0x230, lpBuffer=0x58c668*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58c668*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0052.314] GetProcessHeap () returned 0x560000 [0052.314] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58c668, Size=0x30) returned 0x582c28 [0052.314] GetProcessHeap () returned 0x560000 [0052.314] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.314] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.314] GetProcessHeap () returned 0x560000 [0052.314] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5e70) returned 0x5a4d18 [0052.315] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x5e70, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x5e70, lpOverlapped=0x0) returned 1 [0052.315] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.315] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x5e70, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x5e70, lpOverlapped=0x0) returned 1 [0052.316] GetProcessHeap () returned 0x560000 [0052.316] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.316] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.316] WriteFile (in: hFile=0x230, lpBuffer=0x582c28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x582c28*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.317] CloseHandle (hObject=0x230) returned 1 [0052.318] GetProcessHeap () returned 0x560000 [0052.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0052.318] GetProcessHeap () returned 0x560000 [0052.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.318] GetProcessHeap () returned 0x560000 [0052.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5847a8 | out: hHeap=0x560000) returned 1 [0052.318] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx") returned="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx" [0052.318] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx.badday") returned="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx.badday" [0052.318] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\racpv0.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\racpv0.docx.badday"), dwFlags=0x1) returned 1 [0052.318] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\rACpV0.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.318] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.318] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.319] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.319] GetProcessHeap () returned 0x560000 [0052.319] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.319] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa94da8f0, ftCreationTime.dwHighDateTime=0x1d56da8, ftLastAccessTime.dwLowDateTime=0xcb49bef0, ftLastAccessTime.dwHighDateTime=0x1d55ebf, ftLastWriteTime.dwLowDateTime=0xcb49bef0, ftLastWriteTime.dwHighDateTime=0x1d55ebf, nFileSizeHigh=0x0, nFileSizeLow=0x13847, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rb9JWtW9ryN_.pptx", cAlternateFileName="RB9JWT~1.PPT")) returned 1 [0052.319] lstrcmpiW (lpString1="rb9JWtW9ryN_.pptx", lpString2=".") returned 1 [0052.319] lstrcmpiW (lpString1="rb9JWtW9ryN_.pptx", lpString2="..") returned 1 [0052.319] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="rb9JWtW9ryN_.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx") returned="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx" [0052.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rb9JWtW9ryN_.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0052.319] GetProcessHeap () returned 0x560000 [0052.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576878 [0052.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rb9JWtW9ryN_.pptx", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rb9JWtW9ryN_.pptx", lpUsedDefaultChar=0x0) returned 18 [0052.319] lstrlenA (lpString="rb9JWtW9ryN_.pptx") returned 17 [0052.319] lstrlenA (lpString=".badday") returned 7 [0052.319] lstrlenA (lpString=".badday") returned 7 [0052.319] lstrlenA (lpString="rb9JWtW9ryN_.pptx") returned 17 [0052.319] lstrcmpiA (lpString1="N_.pptx", lpString2=".badday") returned 1 [0052.319] lstrcmpiW (lpString1="rb9JWtW9ryN_.pptx", lpString2="how_to_back_files.html") returned 1 [0052.319] lstrcmpiW (lpString1="rb9JWtW9ryN_.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.319] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.319] lstrcmpiW (lpString1="rb9JWtW9ryN_.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.319] GetProcessHeap () returned 0x560000 [0052.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d328 [0052.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rb9jwtw9ryn_.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.319] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=79943) returned 1 [0052.319] GetProcessHeap () returned 0x560000 [0052.319] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.319] GetProcessHeap () returned 0x560000 [0052.320] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584500 [0052.320] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx") returned 43 [0052.320] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.320] GetProcessHeap () returned 0x560000 [0052.320] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.320] GetProcessHeap () returned 0x560000 [0052.320] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a44e8 [0052.320] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.320] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x585028) returned 1 [0052.320] CryptGenRandom (in: hProv=0x585028, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.320] CryptReleaseContext (hProv=0x585028, dwFlags=0x0) returned 1 [0052.320] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.320] GetProcessHeap () returned 0x560000 [0052.320] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584830 [0052.320] lstrlenA (lpString="010001") returned 6 [0052.320] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584c70 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c70 | out: hHeap=0x560000) returned 1 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586960 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59fef8 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0010 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fa98 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584cf8 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59f638 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.321] GetProcessHeap () returned 0x560000 [0052.321] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f408 [0052.321] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4310 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586a80 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4310 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fbb0 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.322] GetProcessHeap () returned 0x560000 [0052.322] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.322] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.323] GetProcessHeap () returned 0x560000 [0052.323] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.323] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.324] GetProcessHeap () returned 0x560000 [0052.324] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.325] GetProcessHeap () returned 0x560000 [0052.325] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.326] GetProcessHeap () returned 0x560000 [0052.326] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa98 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f638 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbb0 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586960 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0010 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.327] GetProcessHeap () returned 0x560000 [0052.327] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x560000) returned 1 [0052.327] WriteFile (in: hFile=0x230, lpBuffer=0x5a44e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a44e8*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.329] GetProcessHeap () returned 0x560000 [0052.329] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a44e8, Size=0x30) returned 0x5a44e8 [0052.329] GetProcessHeap () returned 0x560000 [0052.329] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.329] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.329] GetProcessHeap () returned 0x560000 [0052.329] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13847) returned 0x5a4d18 [0052.330] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d18, nNumberOfBytesToRead=0x13847, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesRead=0x24ad7e8*=0x13847, lpOverlapped=0x0) returned 1 [0052.331] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.331] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x13847, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad7e4*=0x13847, lpOverlapped=0x0) returned 1 [0052.333] GetProcessHeap () returned 0x560000 [0052.333] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d18 | out: hHeap=0x560000) returned 1 [0052.334] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.334] WriteFile (in: hFile=0x230, lpBuffer=0x5a44e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a44e8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.335] CloseHandle (hObject=0x230) returned 1 [0052.335] GetProcessHeap () returned 0x560000 [0052.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d328 | out: hHeap=0x560000) returned 1 [0052.335] GetProcessHeap () returned 0x560000 [0052.335] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.336] GetProcessHeap () returned 0x560000 [0052.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0052.336] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx") returned="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx" [0052.336] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx.badday" [0052.336] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rb9jwtw9ryn_.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\rb9jwtw9ryn_.pptx.badday"), dwFlags=0x1) returned 1 [0052.336] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\rb9JWtW9ryN_.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.336] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.336] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.336] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.336] GetProcessHeap () returned 0x560000 [0052.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0052.336] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85a57ca0, ftCreationTime.dwHighDateTime=0x1d55b3f, ftLastAccessTime.dwLowDateTime=0x3158bce0, ftLastAccessTime.dwHighDateTime=0x1d54535, ftLastWriteTime.dwLowDateTime=0x3158bce0, ftLastWriteTime.dwHighDateTime=0x1d54535, nFileSizeHigh=0x0, nFileSizeLow=0x1640a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rcW7R.docx", cAlternateFileName="RCW7R~1.DOC")) returned 1 [0052.336] lstrcmpiW (lpString1="rcW7R.docx", lpString2=".") returned 1 [0052.336] lstrcmpiW (lpString1="rcW7R.docx", lpString2="..") returned 1 [0052.336] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="rcW7R.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx") returned="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx" [0052.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rcW7R.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.337] GetProcessHeap () returned 0x560000 [0052.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0052.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rcW7R.docx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rcW7R.docx", lpUsedDefaultChar=0x0) returned 11 [0052.337] lstrlenA (lpString="rcW7R.docx") returned 10 [0052.337] lstrlenA (lpString=".badday") returned 7 [0052.337] lstrlenA (lpString=".badday") returned 7 [0052.337] lstrlenA (lpString="rcW7R.docx") returned 10 [0052.337] lstrcmpiA (lpString1="7R.docx", lpString2=".badday") returned 1 [0052.337] lstrcmpiW (lpString1="rcW7R.docx", lpString2="how_to_back_files.html") returned 1 [0052.337] lstrcmpiW (lpString1="rcW7R.docx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.337] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.337] lstrcmpiW (lpString1="rcW7R.docx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.337] GetProcessHeap () returned 0x560000 [0052.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d288 [0052.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rcw7r.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.337] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=91146) returned 1 [0052.337] GetProcessHeap () returned 0x560000 [0052.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.337] GetProcessHeap () returned 0x560000 [0052.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584478 [0052.337] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx") returned 36 [0052.337] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.338] GetProcessHeap () returned 0x560000 [0052.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.339] GetProcessHeap () returned 0x560000 [0052.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4d18 [0052.340] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.340] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5848b8) returned 1 [0052.340] CryptGenRandom (in: hProv=0x5848b8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.340] CryptReleaseContext (hProv=0x5848b8, dwFlags=0x0) returned 1 [0052.340] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.340] GetProcessHeap () returned 0x560000 [0052.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584830 [0052.340] lstrlenA (lpString="010001") returned 6 [0052.340] GetProcessHeap () returned 0x560000 [0052.340] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586de0 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586a80 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59fbb0 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0010 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f750 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5848b8 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59fef8 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4250 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848b8 | out: hHeap=0x560000) returned 1 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fde0 [0052.341] GetProcessHeap () returned 0x560000 [0052.341] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4208 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5874a0 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4208 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f868 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.342] GetProcessHeap () returned 0x560000 [0052.342] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.342] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.343] GetProcessHeap () returned 0x560000 [0052.343] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.344] GetProcessHeap () returned 0x560000 [0052.344] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.344] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.345] GetProcessHeap () returned 0x560000 [0052.345] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.346] GetProcessHeap () returned 0x560000 [0052.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.346] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f750 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fde0 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f868 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4250 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a80 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbb0 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0010 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.347] GetProcessHeap () returned 0x560000 [0052.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x560000) returned 1 [0052.347] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.350] GetProcessHeap () returned 0x560000 [0052.350] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4d18, Size=0x30) returned 0x5a4d18 [0052.350] GetProcessHeap () returned 0x560000 [0052.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.350] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.350] GetProcessHeap () returned 0x560000 [0052.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1640a) returned 0x5a4d50 [0052.351] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d50, nNumberOfBytesToRead=0x1640a, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d50*, lpNumberOfBytesRead=0x24ad7e8*=0x1640a, lpOverlapped=0x0) returned 1 [0052.353] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.353] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d50*, nNumberOfBytesToWrite=0x1640a, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d50*, lpNumberOfBytesWritten=0x24ad7e4*=0x1640a, lpOverlapped=0x0) returned 1 [0052.354] GetProcessHeap () returned 0x560000 [0052.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d50 | out: hHeap=0x560000) returned 1 [0052.354] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.354] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4d18*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.355] CloseHandle (hObject=0x230) returned 1 [0052.356] GetProcessHeap () returned 0x560000 [0052.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d288 | out: hHeap=0x560000) returned 1 [0052.356] GetProcessHeap () returned 0x560000 [0052.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.356] GetProcessHeap () returned 0x560000 [0052.356] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584478 | out: hHeap=0x560000) returned 1 [0052.356] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx") returned="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx" [0052.356] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx.badday") returned="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx.badday" [0052.356] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rcw7r.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\rcw7r.docx.badday"), dwFlags=0x1) returned 1 [0052.356] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\rcW7R.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.356] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.356] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.356] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.357] GetProcessHeap () returned 0x560000 [0052.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.357] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd793600, ftCreationTime.dwHighDateTime=0x1d56362, ftLastAccessTime.dwLowDateTime=0x16c6e910, ftLastAccessTime.dwHighDateTime=0x1d5377a, ftLastWriteTime.dwLowDateTime=0x16c6e910, ftLastWriteTime.dwHighDateTime=0x1d5377a, nFileSizeHigh=0x0, nFileSizeLow=0x730b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rO9--OQtR2V.docx", cAlternateFileName="RO9--O~1.DOC")) returned 1 [0052.357] lstrcmpiW (lpString1="rO9--OQtR2V.docx", lpString2=".") returned 1 [0052.357] lstrcmpiW (lpString1="rO9--OQtR2V.docx", lpString2="..") returned 1 [0052.357] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="rO9--OQtR2V.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx") returned="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx" [0052.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rO9--OQtR2V.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.357] GetProcessHeap () returned 0x560000 [0052.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576b78 [0052.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rO9--OQtR2V.docx", cchWideChar=-1, lpMultiByteStr=0x576b78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rO9--OQtR2V.docx", lpUsedDefaultChar=0x0) returned 17 [0052.357] lstrlenA (lpString="rO9--OQtR2V.docx") returned 16 [0052.357] lstrlenA (lpString=".badday") returned 7 [0052.357] lstrlenA (lpString=".badday") returned 7 [0052.357] lstrlenA (lpString="rO9--OQtR2V.docx") returned 16 [0052.357] lstrcmpiA (lpString1="2V.docx", lpString2=".badday") returned 1 [0052.357] lstrcmpiW (lpString1="rO9--OQtR2V.docx", lpString2="how_to_back_files.html") returned 1 [0052.357] lstrcmpiW (lpString1="rO9--OQtR2V.docx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.357] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.357] lstrcmpiW (lpString1="rO9--OQtR2V.docx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.357] GetProcessHeap () returned 0x560000 [0052.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0052.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ro9--oqtr2v.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.357] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=29451) returned 1 [0052.357] GetProcessHeap () returned 0x560000 [0052.357] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.357] GetProcessHeap () returned 0x560000 [0052.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e90 [0052.358] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx") returned 42 [0052.358] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.358] GetProcessHeap () returned 0x560000 [0052.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.358] GetProcessHeap () returned 0x560000 [0052.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4d50 [0052.358] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.358] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x585138) returned 1 [0052.358] CryptGenRandom (in: hProv=0x585138, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.358] CryptReleaseContext (hProv=0x585138, dwFlags=0x0) returned 1 [0052.358] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.358] GetProcessHeap () returned 0x560000 [0052.358] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584fa0 [0052.358] lstrlenA (lpString="010001") returned 6 [0052.358] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584cf8 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587020 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59f408 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0010 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f868 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584c70 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0128 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0052.359] GetProcessHeap () returned 0x560000 [0052.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c70 | out: hHeap=0x560000) returned 1 [0052.359] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0240 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4298 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f90 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4298 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fa98 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.360] GetProcessHeap () returned 0x560000 [0052.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.361] GetProcessHeap () returned 0x560000 [0052.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.361] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.362] GetProcessHeap () returned 0x560000 [0052.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.363] GetProcessHeap () returned 0x560000 [0052.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.364] GetProcessHeap () returned 0x560000 [0052.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f868 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0240 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0128 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa98 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587020 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0010 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.365] GetProcessHeap () returned 0x560000 [0052.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584fa0 | out: hHeap=0x560000) returned 1 [0052.365] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d50*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4d50*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.367] GetProcessHeap () returned 0x560000 [0052.367] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4d50, Size=0x30) returned 0x5a4d50 [0052.367] GetProcessHeap () returned 0x560000 [0052.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.367] GetProcessHeap () returned 0x560000 [0052.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x730b) returned 0x5a4d88 [0052.367] ReadFile (in: hFile=0x230, lpBuffer=0x5a4d88, nNumberOfBytesToRead=0x730b, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4d88*, lpNumberOfBytesRead=0x24ad7e8*=0x730b, lpOverlapped=0x0) returned 1 [0052.368] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.368] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d88*, nNumberOfBytesToWrite=0x730b, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4d88*, lpNumberOfBytesWritten=0x24ad7e4*=0x730b, lpOverlapped=0x0) returned 1 [0052.369] GetProcessHeap () returned 0x560000 [0052.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4d88 | out: hHeap=0x560000) returned 1 [0052.370] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.371] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4d50*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.371] CloseHandle (hObject=0x230) returned 1 [0052.372] GetProcessHeap () returned 0x560000 [0052.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0052.372] GetProcessHeap () returned 0x560000 [0052.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.372] GetProcessHeap () returned 0x560000 [0052.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0052.372] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx") returned="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx" [0052.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx.badday") returned="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx.badday" [0052.372] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ro9--oqtr2v.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\ro9--oqtr2v.docx.badday"), dwFlags=0x1) returned 1 [0052.373] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\rO9--OQtR2V.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.373] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.373] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.373] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.373] GetProcessHeap () returned 0x560000 [0052.373] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b78 | out: hHeap=0x560000) returned 1 [0052.373] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce734c0, ftCreationTime.dwHighDateTime=0x1d50a30, ftLastAccessTime.dwLowDateTime=0xdb2f1110, ftLastAccessTime.dwHighDateTime=0x1d4f274, ftLastWriteTime.dwLowDateTime=0xdb2f1110, ftLastWriteTime.dwHighDateTime=0x1d4f274, nFileSizeHigh=0x0, nFileSizeLow=0x6fd3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rrbGitGEC-EiP.pptx", cAlternateFileName="RRBGIT~1.PPT")) returned 1 [0052.373] lstrcmpiW (lpString1="rrbGitGEC-EiP.pptx", lpString2=".") returned 1 [0052.373] lstrcmpiW (lpString1="rrbGitGEC-EiP.pptx", lpString2="..") returned 1 [0052.373] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="rrbGitGEC-EiP.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx") returned="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx" [0052.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rrbGitGEC-EiP.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0052.373] GetProcessHeap () returned 0x560000 [0052.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13) returned 0x5769f8 [0052.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rrbGitGEC-EiP.pptx", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rrbGitGEC-EiP.pptx", lpUsedDefaultChar=0x0) returned 19 [0052.373] lstrlenA (lpString="rrbGitGEC-EiP.pptx") returned 18 [0052.373] lstrlenA (lpString=".badday") returned 7 [0052.373] lstrlenA (lpString=".badday") returned 7 [0052.373] lstrlenA (lpString="rrbGitGEC-EiP.pptx") returned 18 [0052.373] lstrcmpiA (lpString1="iP.pptx", lpString2=".badday") returned 1 [0052.373] lstrcmpiW (lpString1="rrbGitGEC-EiP.pptx", lpString2="how_to_back_files.html") returned 1 [0052.373] lstrcmpiW (lpString1="rrbGitGEC-EiP.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.373] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.373] lstrcmpiW (lpString1="rrbGitGEC-EiP.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.373] GetProcessHeap () returned 0x560000 [0052.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0052.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rrbgitgec-eip.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.374] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=28627) returned 1 [0052.374] GetProcessHeap () returned 0x560000 [0052.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.374] GetProcessHeap () returned 0x560000 [0052.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584c70 [0052.374] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx") returned 44 [0052.374] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.374] GetProcessHeap () returned 0x560000 [0052.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.374] GetProcessHeap () returned 0x560000 [0052.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4d88 [0052.377] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.377] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584720) returned 1 [0052.377] CryptGenRandom (in: hProv=0x584720, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.377] CryptReleaseContext (hProv=0x584720, dwFlags=0x0) returned 1 [0052.377] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.377] GetProcessHeap () returned 0x560000 [0052.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585138 [0052.377] lstrlenA (lpString="010001") returned 6 [0052.377] GetProcessHeap () returned 0x560000 [0052.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584368 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586600 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584368 | out: hHeap=0x560000) returned 1 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5874a0 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59fcc8 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f750 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0128 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584a50 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59f638 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x587530 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584a50 | out: hHeap=0x560000) returned 1 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fde0 [0052.378] GetProcessHeap () returned 0x560000 [0052.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587530 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4340 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586c30 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4340 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f980 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c30 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.379] GetProcessHeap () returned 0x560000 [0052.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.379] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.380] GetProcessHeap () returned 0x560000 [0052.380] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.381] GetProcessHeap () returned 0x560000 [0052.381] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.381] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.382] GetProcessHeap () returned 0x560000 [0052.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0128 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fde0 | out: hHeap=0x560000) returned 1 [0052.383] GetProcessHeap () returned 0x560000 [0052.383] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f638 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f980 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874a0 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fcc8 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f750 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.384] GetProcessHeap () returned 0x560000 [0052.384] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585138 | out: hHeap=0x560000) returned 1 [0052.384] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d88*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4d88*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.387] GetProcessHeap () returned 0x560000 [0052.387] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4d88, Size=0x30) returned 0x5a4d88 [0052.387] GetProcessHeap () returned 0x560000 [0052.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.387] GetProcessHeap () returned 0x560000 [0052.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6fd3) returned 0x5a4dc0 [0052.387] ReadFile (in: hFile=0x230, lpBuffer=0x5a4dc0, nNumberOfBytesToRead=0x6fd3, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4dc0*, lpNumberOfBytesRead=0x24ad7e8*=0x6fd3, lpOverlapped=0x0) returned 1 [0052.388] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.388] WriteFile (in: hFile=0x230, lpBuffer=0x5a4dc0*, nNumberOfBytesToWrite=0x6fd3, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4dc0*, lpNumberOfBytesWritten=0x24ad7e4*=0x6fd3, lpOverlapped=0x0) returned 1 [0052.389] GetProcessHeap () returned 0x560000 [0052.389] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4dc0 | out: hHeap=0x560000) returned 1 [0052.389] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.389] WriteFile (in: hFile=0x230, lpBuffer=0x5a4d88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4d88*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.390] CloseHandle (hObject=0x230) returned 1 [0052.391] GetProcessHeap () returned 0x560000 [0052.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0052.391] GetProcessHeap () returned 0x560000 [0052.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.391] GetProcessHeap () returned 0x560000 [0052.391] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c70 | out: hHeap=0x560000) returned 1 [0052.391] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx") returned="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx" [0052.391] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx.badday" [0052.391] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rrbgitgec-eip.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\rrbgitgec-eip.pptx.badday"), dwFlags=0x1) returned 1 [0052.395] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\rrbGitGEC-EiP.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.395] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.395] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.395] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.395] GetProcessHeap () returned 0x560000 [0052.395] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0052.395] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x407d2a40, ftCreationTime.dwHighDateTime=0x1d526ad, ftLastAccessTime.dwLowDateTime=0x4d44c3a0, ftLastAccessTime.dwHighDateTime=0x1d52f7c, ftLastWriteTime.dwLowDateTime=0x4d44c3a0, ftLastWriteTime.dwHighDateTime=0x1d52f7c, nFileSizeHigh=0x0, nFileSizeLow=0x172c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tput9dDZUOp5nm-c.xlsx", cAlternateFileName="TPUT9D~1.XLS")) returned 1 [0052.395] lstrcmpiW (lpString1="tput9dDZUOp5nm-c.xlsx", lpString2=".") returned 1 [0052.395] lstrcmpiW (lpString1="tput9dDZUOp5nm-c.xlsx", lpString2="..") returned 1 [0052.395] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="tput9dDZUOp5nm-c.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx" [0052.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tput9dDZUOp5nm-c.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0052.395] GetProcessHeap () returned 0x560000 [0052.395] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576878 [0052.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tput9dDZUOp5nm-c.xlsx", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tput9dDZUOp5nm-c.xlsx", lpUsedDefaultChar=0x0) returned 22 [0052.395] lstrlenA (lpString="tput9dDZUOp5nm-c.xlsx") returned 21 [0052.395] lstrlenA (lpString=".badday") returned 7 [0052.395] lstrlenA (lpString=".badday") returned 7 [0052.395] lstrlenA (lpString="tput9dDZUOp5nm-c.xlsx") returned 21 [0052.396] lstrcmpiA (lpString1="-c.xlsx", lpString2=".badday") returned 1 [0052.396] lstrcmpiW (lpString1="tput9dDZUOp5nm-c.xlsx", lpString2="how_to_back_files.html") returned 1 [0052.396] lstrcmpiW (lpString1="tput9dDZUOp5nm-c.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.396] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.396] lstrcmpiW (lpString1="tput9dDZUOp5nm-c.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.396] GetProcessHeap () returned 0x560000 [0052.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0052.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tput9ddzuop5nm-c.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.396] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=94917) returned 1 [0052.396] GetProcessHeap () returned 0x560000 [0052.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.396] GetProcessHeap () returned 0x560000 [0052.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e90 [0052.396] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx") returned 47 [0052.396] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.396] GetProcessHeap () returned 0x560000 [0052.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.396] GetProcessHeap () returned 0x560000 [0052.396] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4dc0 [0052.396] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.396] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584c70) returned 1 [0052.397] CryptGenRandom (in: hProv=0x584c70, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.397] CryptReleaseContext (hProv=0x584c70, dwFlags=0x0) returned 1 [0052.397] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5850b0 [0052.397] lstrlenA (lpString="010001") returned 6 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584500 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586e70 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584500 | out: hHeap=0x560000) returned 1 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0010 [0052.397] GetProcessHeap () returned 0x560000 [0052.397] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0128 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f638 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x585248 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a0240 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5871d0 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585248 | out: hHeap=0x560000) returned 1 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fde0 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871d0 | out: hHeap=0x560000) returned 1 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4388 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.398] GetProcessHeap () returned 0x560000 [0052.398] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586cc0 [0052.398] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f868 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.399] GetProcessHeap () returned 0x560000 [0052.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.399] GetProcessHeap () returned 0x560000 [0052.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.400] GetProcessHeap () returned 0x560000 [0052.400] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.401] GetProcessHeap () returned 0x560000 [0052.401] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.401] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.402] GetProcessHeap () returned 0x560000 [0052.402] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.403] GetProcessHeap () returned 0x560000 [0052.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f638 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fde0 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0240 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f868 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0010 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0128 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.404] GetProcessHeap () returned 0x560000 [0052.404] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5850b0 | out: hHeap=0x560000) returned 1 [0052.404] WriteFile (in: hFile=0x230, lpBuffer=0x5a4dc0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4dc0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.407] GetProcessHeap () returned 0x560000 [0052.407] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4dc0, Size=0x30) returned 0x5a4dc0 [0052.407] GetProcessHeap () returned 0x560000 [0052.407] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.407] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.407] GetProcessHeap () returned 0x560000 [0052.407] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x172c5) returned 0x5a4df8 [0052.409] ReadFile (in: hFile=0x230, lpBuffer=0x5a4df8, nNumberOfBytesToRead=0x172c5, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a4df8*, lpNumberOfBytesRead=0x24ad7e8*=0x172c5, lpOverlapped=0x0) returned 1 [0052.410] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.410] WriteFile (in: hFile=0x230, lpBuffer=0x5a4df8*, nNumberOfBytesToWrite=0x172c5, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a4df8*, lpNumberOfBytesWritten=0x24ad7e4*=0x172c5, lpOverlapped=0x0) returned 1 [0052.412] GetProcessHeap () returned 0x560000 [0052.412] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4df8 | out: hHeap=0x560000) returned 1 [0052.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.412] WriteFile (in: hFile=0x230, lpBuffer=0x5a4dc0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4dc0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.413] CloseHandle (hObject=0x230) returned 1 [0052.414] GetProcessHeap () returned 0x560000 [0052.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0052.414] GetProcessHeap () returned 0x560000 [0052.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.414] GetProcessHeap () returned 0x560000 [0052.414] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0052.414] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx" [0052.414] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx.badday" [0052.414] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tput9ddzuop5nm-c.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\tput9ddzuop5nm-c.xlsx.badday"), dwFlags=0x1) returned 1 [0052.415] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\tput9dDZUOp5nm-c.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.415] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.415] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.415] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.415] GetProcessHeap () returned 0x560000 [0052.415] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0052.415] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf05cbd20, ftCreationTime.dwHighDateTime=0x1d538c5, ftLastAccessTime.dwLowDateTime=0xd2a6a780, ftLastAccessTime.dwHighDateTime=0x1d52099, ftLastWriteTime.dwLowDateTime=0xd2a6a780, ftLastWriteTime.dwHighDateTime=0x1d52099, nFileSizeHigh=0x0, nFileSizeLow=0x18853, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U8hmI 1PtNe3rFL1nw73.xlsx", cAlternateFileName="U8HMI1~1.XLS")) returned 1 [0052.415] lstrcmpiW (lpString1="U8hmI 1PtNe3rFL1nw73.xlsx", lpString2=".") returned 1 [0052.415] lstrcmpiW (lpString1="U8hmI 1PtNe3rFL1nw73.xlsx", lpString2="..") returned 1 [0052.415] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="U8hmI 1PtNe3rFL1nw73.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx" [0052.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U8hmI 1PtNe3rFL1nw73.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0052.415] GetProcessHeap () returned 0x560000 [0052.415] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x57d2d8 [0052.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U8hmI 1PtNe3rFL1nw73.xlsx", cchWideChar=-1, lpMultiByteStr=0x57d2d8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U8hmI 1PtNe3rFL1nw73.xlsx", lpUsedDefaultChar=0x0) returned 26 [0052.415] lstrlenA (lpString="U8hmI 1PtNe3rFL1nw73.xlsx") returned 25 [0052.415] lstrlenA (lpString=".badday") returned 7 [0052.415] lstrlenA (lpString=".badday") returned 7 [0052.415] lstrlenA (lpString="U8hmI 1PtNe3rFL1nw73.xlsx") returned 25 [0052.415] lstrcmpiA (lpString1="73.xlsx", lpString2=".badday") returned 1 [0052.415] lstrcmpiW (lpString1="U8hmI 1PtNe3rFL1nw73.xlsx", lpString2="how_to_back_files.html") returned 1 [0052.415] lstrcmpiW (lpString1="U8hmI 1PtNe3rFL1nw73.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.415] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.416] lstrcmpiW (lpString1="U8hmI 1PtNe3rFL1nw73.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.416] GetProcessHeap () returned 0x560000 [0052.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0052.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\u8hmi 1ptne3rfl1nw73.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.416] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=100435) returned 1 [0052.416] GetProcessHeap () returned 0x560000 [0052.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.416] GetProcessHeap () returned 0x560000 [0052.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584c70 [0052.416] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx") returned 51 [0052.416] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.416] GetProcessHeap () returned 0x560000 [0052.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.416] GetProcessHeap () returned 0x560000 [0052.416] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x38d) returned 0x58c668 [0052.416] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.416] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584cf8) returned 1 [0052.417] CryptGenRandom (in: hProv=0x584cf8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.417] CryptReleaseContext (hProv=0x584cf8, dwFlags=0x0) returned 1 [0052.417] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584588 [0052.417] lstrlenA (lpString="010001") returned 6 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5843f0 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5843f0 | out: hHeap=0x560000) returned 1 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586cc0 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a0128 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.417] GetProcessHeap () returned 0x560000 [0052.417] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f408 [0052.417] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0240 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584698 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59f520 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5870b0 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584698 | out: hHeap=0x560000) returned 1 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59fef8 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870b0 | out: hHeap=0x560000) returned 1 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a43a0 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586e70 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a43a0 | out: hHeap=0x560000) returned 1 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f868 [0052.418] GetProcessHeap () returned 0x560000 [0052.418] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e70 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.419] GetProcessHeap () returned 0x560000 [0052.419] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.420] GetProcessHeap () returned 0x560000 [0052.420] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.420] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.421] GetProcessHeap () returned 0x560000 [0052.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.422] GetProcessHeap () returned 0x560000 [0052.422] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.422] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0240 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f520 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f868 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586cc0 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.423] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0128 | out: hHeap=0x560000) returned 1 [0052.423] GetProcessHeap () returned 0x560000 [0052.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0052.424] GetProcessHeap () returned 0x560000 [0052.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0052.424] GetProcessHeap () returned 0x560000 [0052.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.424] GetProcessHeap () returned 0x560000 [0052.424] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584588 | out: hHeap=0x560000) returned 1 [0052.424] WriteFile (in: hFile=0x230, lpBuffer=0x58c668*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58c668*, lpNumberOfBytesWritten=0x24ad864*=0x38d, lpOverlapped=0x0) returned 1 [0052.426] GetProcessHeap () returned 0x560000 [0052.426] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58c668, Size=0x30) returned 0x582b48 [0052.426] GetProcessHeap () returned 0x560000 [0052.426] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.426] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.426] GetProcessHeap () returned 0x560000 [0052.426] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18860) returned 0x5a5e00 [0052.427] ReadFile (in: hFile=0x230, lpBuffer=0x5a5e00, nNumberOfBytesToRead=0x18860, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a5e00*, lpNumberOfBytesRead=0x24ad7e8*=0x18860, lpOverlapped=0x0) returned 1 [0052.428] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.428] WriteFile (in: hFile=0x230, lpBuffer=0x5a5e00*, nNumberOfBytesToWrite=0x18860, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a5e00*, lpNumberOfBytesWritten=0x24ad7e4*=0x18860, lpOverlapped=0x0) returned 1 [0052.429] GetProcessHeap () returned 0x560000 [0052.430] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a5e00 | out: hHeap=0x560000) returned 1 [0052.430] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.430] WriteFile (in: hFile=0x230, lpBuffer=0x582b48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x582b48*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.431] CloseHandle (hObject=0x230) returned 1 [0052.432] GetProcessHeap () returned 0x560000 [0052.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0052.432] GetProcessHeap () returned 0x560000 [0052.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.432] GetProcessHeap () returned 0x560000 [0052.432] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584c70 | out: hHeap=0x560000) returned 1 [0052.432] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx" [0052.432] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx.badday" [0052.432] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\u8hmi 1ptne3rfl1nw73.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\u8hmi 1ptne3rfl1nw73.xlsx.badday"), dwFlags=0x1) returned 1 [0052.433] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\U8hmI 1PtNe3rFL1nw73.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.433] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.433] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.433] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.433] GetProcessHeap () returned 0x560000 [0052.433] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d2d8 | out: hHeap=0x560000) returned 1 [0052.433] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dec46f0, ftCreationTime.dwHighDateTime=0x1d4d047, ftLastAccessTime.dwLowDateTime=0x78c083b0, ftLastAccessTime.dwHighDateTime=0x1d4cc8b, ftLastWriteTime.dwLowDateTime=0x78c083b0, ftLastWriteTime.dwHighDateTime=0x1d4cc8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XxvpkL3pzhyiXpEsq5Z", cAlternateFileName="XXVPKL~1")) returned 1 [0052.433] lstrcmpiW (lpString1="XxvpkL3pzhyiXpEsq5Z", lpString2=".") returned 1 [0052.433] lstrcmpiW (lpString1="XxvpkL3pzhyiXpEsq5Z", lpString2="..") returned 1 [0052.433] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="XxvpkL3pzhyiXpEsq5Z" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z" [0052.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XxvpkL3pzhyiXpEsq5Z", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0052.433] GetProcessHeap () returned 0x560000 [0052.433] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5769f8 [0052.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XxvpkL3pzhyiXpEsq5Z", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XxvpkL3pzhyiXpEsq5Z", lpUsedDefaultChar=0x0) returned 20 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0052.433] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0052.434] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.435] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0052.435] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0052.435] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XxvpkL3pzhyiXpEsq5Z", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0052.435] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\" [0052.435] GetProcessHeap () returned 0x560000 [0052.435] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a198 [0052.435] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned 46 [0052.435] GetProcessHeap () returned 0x560000 [0052.435] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5e) returned 0x572a40 [0052.435] lstrcpyW (in: lpString1=0x572a40, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\" [0052.435] GetProcessHeap () returned 0x560000 [0052.435] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabd57a60, ftCreationTime.dwHighDateTime=0x1d521fb, ftLastAccessTime.dwLowDateTime=0xe34a7710, ftLastAccessTime.dwHighDateTime=0x1d551e0, ftLastWriteTime.dwLowDateTime=0xe34a7710, ftLastWriteTime.dwHighDateTime=0x1d551e0, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z6Wu.docx", cAlternateFileName="Z6WU~1.DOC")) returned 1 [0052.435] lstrcmpiW (lpString1="z6Wu.docx", lpString2=".") returned 1 [0052.435] lstrcmpiW (lpString1="z6Wu.docx", lpString2="..") returned 1 [0052.435] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="z6Wu.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx") returned="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx" [0052.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="z6Wu.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.435] GetProcessHeap () returned 0x560000 [0052.435] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0052.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="z6Wu.docx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z6Wu.docx", lpUsedDefaultChar=0x0) returned 10 [0052.435] lstrlenA (lpString="z6Wu.docx") returned 9 [0052.435] lstrlenA (lpString=".badday") returned 7 [0052.435] lstrlenA (lpString=".badday") returned 7 [0052.435] lstrlenA (lpString="z6Wu.docx") returned 9 [0052.435] lstrcmpiA (lpString1="Wu.docx", lpString2=".badday") returned 1 [0052.435] lstrcmpiW (lpString1="z6Wu.docx", lpString2="how_to_back_files.html") returned 1 [0052.435] lstrcmpiW (lpString1="z6Wu.docx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.435] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.435] lstrcmpiW (lpString1="z6Wu.docx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.435] GetProcessHeap () returned 0x560000 [0052.435] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d3c8 [0052.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\z6wu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.436] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=35575) returned 1 [0052.436] GetProcessHeap () returned 0x560000 [0052.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.436] GetProcessHeap () returned 0x560000 [0052.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584698 [0052.436] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx") returned 35 [0052.436] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.436] GetProcessHeap () returned 0x560000 [0052.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.436] GetProcessHeap () returned 0x560000 [0052.436] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58bb70 [0052.436] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.436] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584478) returned 1 [0052.437] CryptGenRandom (in: hProv=0x584478, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.437] CryptReleaseContext (hProv=0x584478, dwFlags=0x0) returned 1 [0052.437] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5848b8 [0052.437] lstrlenA (lpString="010001") returned 6 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584ad8 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586d50 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584ad8 | out: hHeap=0x560000) returned 1 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5869f0 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59fef8 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f980 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f638 [0052.437] GetProcessHeap () returned 0x560000 [0052.437] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584588 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59fcc8 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a43b8 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f90 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584588 | out: hHeap=0x560000) returned 1 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f868 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a43a0 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586f00 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a43a0 | out: hHeap=0x560000) returned 1 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0010 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0052.438] GetProcessHeap () returned 0x560000 [0052.438] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.438] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.439] GetProcessHeap () returned 0x560000 [0052.439] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.439] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.440] GetProcessHeap () returned 0x560000 [0052.440] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.441] GetProcessHeap () returned 0x560000 [0052.441] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.442] GetProcessHeap () returned 0x560000 [0052.442] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.442] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f638 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f868 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fcc8 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0010 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a43b8 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869f0 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d50 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f980 | out: hHeap=0x560000) returned 1 [0052.443] GetProcessHeap () returned 0x560000 [0052.443] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.444] GetProcessHeap () returned 0x560000 [0052.444] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5848b8 | out: hHeap=0x560000) returned 1 [0052.444] WriteFile (in: hFile=0x230, lpBuffer=0x58bb70*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58bb70*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0052.447] GetProcessHeap () returned 0x560000 [0052.447] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58bb70, Size=0x30) returned 0x582918 [0052.447] GetProcessHeap () returned 0x560000 [0052.447] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.447] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.447] GetProcessHeap () returned 0x560000 [0052.448] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8b00) returned 0x5a6200 [0052.448] ReadFile (in: hFile=0x230, lpBuffer=0x5a6200, nNumberOfBytesToRead=0x8b00, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a6200*, lpNumberOfBytesRead=0x24ad7e8*=0x8b00, lpOverlapped=0x0) returned 1 [0052.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.448] WriteFile (in: hFile=0x230, lpBuffer=0x5a6200*, nNumberOfBytesToWrite=0x8b00, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a6200*, lpNumberOfBytesWritten=0x24ad7e4*=0x8b00, lpOverlapped=0x0) returned 1 [0052.449] GetProcessHeap () returned 0x560000 [0052.449] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6200 | out: hHeap=0x560000) returned 1 [0052.451] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.451] WriteFile (in: hFile=0x230, lpBuffer=0x582918*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x582918*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.451] CloseHandle (hObject=0x230) returned 1 [0052.452] GetProcessHeap () returned 0x560000 [0052.452] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d3c8 | out: hHeap=0x560000) returned 1 [0052.452] GetProcessHeap () returned 0x560000 [0052.452] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.452] GetProcessHeap () returned 0x560000 [0052.452] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584698 | out: hHeap=0x560000) returned 1 [0052.452] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx") returned="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx" [0052.452] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx.badday") returned="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx.badday" [0052.452] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\z6wu.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\z6wu.docx.badday"), dwFlags=0x1) returned 1 [0052.453] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\z6Wu.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.453] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.453] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.453] GetProcessHeap () returned 0x560000 [0052.453] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.453] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6174d0, ftCreationTime.dwHighDateTime=0x1d4d480, ftLastAccessTime.dwLowDateTime=0x4aad1550, ftLastAccessTime.dwHighDateTime=0x1d4cb01, ftLastWriteTime.dwLowDateTime=0x4aad1550, ftLastWriteTime.dwHighDateTime=0x1d4cb01, nFileSizeHigh=0x0, nFileSizeLow=0x155bd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zypwIPPBc-.ods", cAlternateFileName="ZYPWIP~1.ODS")) returned 1 [0052.453] lstrcmpiW (lpString1="zypwIPPBc-.ods", lpString2=".") returned 1 [0052.453] lstrcmpiW (lpString1="zypwIPPBc-.ods", lpString2="..") returned 1 [0052.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="zypwIPPBc-.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods") returned="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods" [0052.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zypwIPPBc-.ods", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.453] GetProcessHeap () returned 0x560000 [0052.453] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0052.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zypwIPPBc-.ods", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zypwIPPBc-.ods", lpUsedDefaultChar=0x0) returned 15 [0052.453] lstrlenA (lpString="zypwIPPBc-.ods") returned 14 [0052.453] lstrlenA (lpString=".badday") returned 7 [0052.453] lstrlenA (lpString=".badday") returned 7 [0052.453] lstrlenA (lpString="zypwIPPBc-.ods") returned 14 [0052.453] lstrcmpiA (lpString1="Bc-.ods", lpString2=".badday") returned 1 [0052.453] lstrcmpiW (lpString1="zypwIPPBc-.ods", lpString2="how_to_back_files.html") returned 1 [0052.453] lstrcmpiW (lpString1="zypwIPPBc-.ods", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.454] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.454] lstrcmpiW (lpString1="zypwIPPBc-.ods", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.454] GetProcessHeap () returned 0x560000 [0052.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0052.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods" (normalized: "c:\\users\\fd1hvy\\documents\\zypwippbc-.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.454] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=87485) returned 1 [0052.454] GetProcessHeap () returned 0x560000 [0052.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.454] GetProcessHeap () returned 0x560000 [0052.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584e90 [0052.454] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods") returned 40 [0052.454] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.454] GetProcessHeap () returned 0x560000 [0052.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.454] GetProcessHeap () returned 0x560000 [0052.454] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x383) returned 0x5a6200 [0052.455] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.455] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x584588) returned 1 [0052.456] CryptGenRandom (in: hProv=0x584588, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.456] CryptReleaseContext (hProv=0x584588, dwFlags=0x0) returned 1 [0052.456] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584940 [0052.456] lstrlenA (lpString="010001") returned 6 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584478 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x586f00 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584478 | out: hHeap=0x560000) returned 1 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5872f0 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x59f408 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0128 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f750 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x584cf8 [0052.456] GetProcessHeap () returned 0x560000 [0052.456] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x59fef8 [0052.456] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a40e8 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5867b0 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584cf8 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a0240 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5867b0 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4118 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x586de0 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4118 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x59f520 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586de0 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.457] GetProcessHeap () returned 0x560000 [0052.457] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.458] GetProcessHeap () returned 0x560000 [0052.458] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.459] GetProcessHeap () returned 0x560000 [0052.459] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.460] GetProcessHeap () returned 0x560000 [0052.460] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.460] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.461] GetProcessHeap () returned 0x560000 [0052.461] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f750 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0240 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fef8 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f520 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a40e8 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872f0 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f00 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0128 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.462] GetProcessHeap () returned 0x560000 [0052.462] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584940 | out: hHeap=0x560000) returned 1 [0052.462] WriteFile (in: hFile=0x230, lpBuffer=0x5a6200*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a6200*, lpNumberOfBytesWritten=0x24ad864*=0x383, lpOverlapped=0x0) returned 1 [0052.465] GetProcessHeap () returned 0x560000 [0052.465] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a6200, Size=0x30) returned 0x5a6200 [0052.465] GetProcessHeap () returned 0x560000 [0052.465] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.465] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.465] GetProcessHeap () returned 0x560000 [0052.465] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x155c0) returned 0x5a6238 [0052.466] ReadFile (in: hFile=0x230, lpBuffer=0x5a6238, nNumberOfBytesToRead=0x155c0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a6238*, lpNumberOfBytesRead=0x24ad7e8*=0x155c0, lpOverlapped=0x0) returned 1 [0052.467] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.468] WriteFile (in: hFile=0x230, lpBuffer=0x5a6238*, nNumberOfBytesToWrite=0x155c0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a6238*, lpNumberOfBytesWritten=0x24ad7e4*=0x155c0, lpOverlapped=0x0) returned 1 [0052.469] GetProcessHeap () returned 0x560000 [0052.469] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6238 | out: hHeap=0x560000) returned 1 [0052.469] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.469] WriteFile (in: hFile=0x230, lpBuffer=0x5a6200*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a6200*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.470] CloseHandle (hObject=0x230) returned 1 [0052.470] GetProcessHeap () returned 0x560000 [0052.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0052.470] GetProcessHeap () returned 0x560000 [0052.470] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.470] GetProcessHeap () returned 0x560000 [0052.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x584e90 | out: hHeap=0x560000) returned 1 [0052.471] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods") returned="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods" [0052.471] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods.badday") returned="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods.badday" [0052.471] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods" (normalized: "c:\\users\\fd1hvy\\documents\\zypwippbc-.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods.badday" (normalized: "c:\\users\\fd1hvy\\documents\\zypwippbc-.ods.badday"), dwFlags=0x1) returned 1 [0052.471] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\zypwIPPBc-.ods" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0052.471] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0052.471] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" [0052.471] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\how_to_back_files.html")) returned 0x20 [0052.471] GetProcessHeap () returned 0x560000 [0052.471] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.471] FindNextFileW (in: hFindFile=0x579608, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6174d0, ftCreationTime.dwHighDateTime=0x1d4d480, ftLastAccessTime.dwLowDateTime=0x4aad1550, ftLastAccessTime.dwHighDateTime=0x1d4cb01, ftLastWriteTime.dwLowDateTime=0x4aad1550, ftLastWriteTime.dwHighDateTime=0x1d4cb01, nFileSizeHigh=0x0, nFileSizeLow=0x155bd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zypwIPPBc-.ods", cAlternateFileName="ZYPWIP~1.ODS")) returned 0 [0052.471] FindClose (in: hFindFile=0x579608 | out: hFindFile=0x579608) returned 1 [0052.471] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\" [0052.472] GetProcessHeap () returned 0x560000 [0052.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0052.472] GetProcessHeap () returned 0x560000 [0052.472] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.472] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned 46 [0052.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\*") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\*" [0052.472] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dec46f0, ftCreationTime.dwHighDateTime=0x1d4d047, ftLastAccessTime.dwLowDateTime=0x78c083b0, ftLastAccessTime.dwHighDateTime=0x1d4cc8b, ftLastWriteTime.dwLowDateTime=0x78c083b0, ftLastWriteTime.dwHighDateTime=0x1d4cc8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579888 [0052.472] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.472] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dec46f0, ftCreationTime.dwHighDateTime=0x1d4d047, ftLastAccessTime.dwLowDateTime=0x78c083b0, ftLastAccessTime.dwHighDateTime=0x1d4cc8b, ftLastWriteTime.dwLowDateTime=0x78c083b0, ftLastWriteTime.dwHighDateTime=0x1d4cc8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.472] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.472] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.472] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x335a510, ftCreationTime.dwHighDateTime=0x1d4d2c3, ftLastAccessTime.dwLowDateTime=0xb1060bf0, ftLastAccessTime.dwHighDateTime=0x1d4d1e0, ftLastWriteTime.dwLowDateTime=0xb1060bf0, ftLastWriteTime.dwHighDateTime=0x1d4d1e0, nFileSizeHigh=0x0, nFileSizeLow=0xc897, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B8D83re2zNj-nujj1XV.pdf", cAlternateFileName="B8D83R~1.PDF")) returned 1 [0052.472] lstrcmpiW (lpString1="B8D83re2zNj-nujj1XV.pdf", lpString2=".") returned 1 [0052.472] lstrcmpiW (lpString1="B8D83re2zNj-nujj1XV.pdf", lpString2="..") returned 1 [0052.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="B8D83re2zNj-nujj1XV.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf" [0052.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B8D83re2zNj-nujj1XV.pdf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0052.472] GetProcessHeap () returned 0x560000 [0052.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576ab8 [0052.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B8D83re2zNj-nujj1XV.pdf", cchWideChar=-1, lpMultiByteStr=0x576ab8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B8D83re2zNj-nujj1XV.pdf", lpUsedDefaultChar=0x0) returned 24 [0052.472] lstrlenA (lpString="B8D83re2zNj-nujj1XV.pdf") returned 23 [0052.472] lstrlenA (lpString=".badday") returned 7 [0052.472] lstrlenA (lpString=".badday") returned 7 [0052.472] lstrlenA (lpString="B8D83re2zNj-nujj1XV.pdf") returned 23 [0052.472] lstrcmpiA (lpString1="1XV.pdf", lpString2=".badday") returned 1 [0052.472] lstrcmpiW (lpString1="B8D83re2zNj-nujj1XV.pdf", lpString2="how_to_back_files.html") returned -1 [0052.472] lstrcmpiW (lpString1="B8D83re2zNj-nujj1XV.pdf", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.472] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.473] lstrcmpiW (lpString1="B8D83re2zNj-nujj1XV.pdf", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.473] GetProcessHeap () returned 0x560000 [0052.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d468 [0052.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\b8d83re2znj-nujj1xv.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.473] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=51351) returned 1 [0052.473] GetProcessHeap () returned 0x560000 [0052.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.473] GetProcessHeap () returned 0x560000 [0052.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587018 [0052.473] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf") returned 69 [0052.473] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.473] GetProcessHeap () returned 0x560000 [0052.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.473] GetProcessHeap () returned 0x560000 [0052.473] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x389) returned 0x58bb70 [0052.473] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.473] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5870a0) returned 1 [0052.474] CryptGenRandom (in: hProv=0x5870a0, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.474] CryptReleaseContext (hProv=0x5870a0, dwFlags=0x0) returned 1 [0052.474] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587348 [0052.474] lstrlenA (lpString="010001") returned 6 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586710 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fb58 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586710 | out: hHeap=0x560000) returned 1 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59feb8 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1450 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a008 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1568 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1ae0 [0052.474] GetProcessHeap () returned 0x560000 [0052.474] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586710 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a2058 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ff48 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586710 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2288 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff48 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4238 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5a0188 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4238 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1680 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0188 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.475] GetProcessHeap () returned 0x560000 [0052.475] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.475] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.476] GetProcessHeap () returned 0x560000 [0052.476] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.476] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.477] GetProcessHeap () returned 0x560000 [0052.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.478] GetProcessHeap () returned 0x560000 [0052.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.479] GetProcessHeap () returned 0x560000 [0052.479] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2288 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2058 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1680 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59feb8 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb58 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1568 | out: hHeap=0x560000) returned 1 [0052.480] GetProcessHeap () returned 0x560000 [0052.480] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.481] GetProcessHeap () returned 0x560000 [0052.481] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587348 | out: hHeap=0x560000) returned 1 [0052.481] WriteFile (in: hFile=0x230, lpBuffer=0x58bb70*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x58bb70*, lpNumberOfBytesWritten=0x24ad864*=0x389, lpOverlapped=0x0) returned 1 [0052.483] GetProcessHeap () returned 0x560000 [0052.483] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x58bb70, Size=0x30) returned 0x582950 [0052.483] GetProcessHeap () returned 0x560000 [0052.483] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.483] GetProcessHeap () returned 0x560000 [0052.483] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc8a0) returned 0x5a6238 [0052.483] ReadFile (in: hFile=0x230, lpBuffer=0x5a6238, nNumberOfBytesToRead=0xc8a0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a6238*, lpNumberOfBytesRead=0x24ad7e8*=0xc8a0, lpOverlapped=0x0) returned 1 [0052.484] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.484] WriteFile (in: hFile=0x230, lpBuffer=0x5a6238*, nNumberOfBytesToWrite=0xc8a0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a6238*, lpNumberOfBytesWritten=0x24ad7e4*=0xc8a0, lpOverlapped=0x0) returned 1 [0052.485] GetProcessHeap () returned 0x560000 [0052.485] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6238 | out: hHeap=0x560000) returned 1 [0052.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.486] WriteFile (in: hFile=0x230, lpBuffer=0x582950*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x582950*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.487] CloseHandle (hObject=0x230) returned 1 [0052.487] GetProcessHeap () returned 0x560000 [0052.487] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d468 | out: hHeap=0x560000) returned 1 [0052.487] GetProcessHeap () returned 0x560000 [0052.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.488] GetProcessHeap () returned 0x560000 [0052.488] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587018 | out: hHeap=0x560000) returned 1 [0052.488] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf" [0052.488] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf.badday") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf.badday" [0052.488] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\b8d83re2znj-nujj1xv.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf.badday" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\b8d83re2znj-nujj1xv.pdf.badday"), dwFlags=0x1) returned 1 [0052.488] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\B8D83re2zNj-nujj1XV.pdf" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z") returned 1 [0052.488] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="" [0052.488] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" [0052.488] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\how_to_back_files.html")) returned 0xffffffff [0052.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0052.489] GetProcessHeap () returned 0x560000 [0052.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.489] GetProcessHeap () returned 0x560000 [0052.489] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586820 [0052.498] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.509] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.511] GetProcessHeap () returned 0x560000 [0052.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.512] GetProcessHeap () returned 0x560000 [0052.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586820 | out: hHeap=0x560000) returned 1 [0052.512] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0052.512] GetProcessHeap () returned 0x560000 [0052.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.512] GetProcessHeap () returned 0x560000 [0052.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586f08 [0052.518] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.522] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.577] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.602] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.618] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.620] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.621] GetProcessHeap () returned 0x560000 [0052.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.621] GetProcessHeap () returned 0x560000 [0052.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f08 | out: hHeap=0x560000) returned 1 [0052.621] CloseHandle (hObject=0x230) returned 1 [0052.621] GetProcessHeap () returned 0x560000 [0052.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576ab8 | out: hHeap=0x560000) returned 1 [0052.621] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4484cd00, ftCreationTime.dwHighDateTime=0x1d4d180, ftLastAccessTime.dwLowDateTime=0x5abc7920, ftLastAccessTime.dwHighDateTime=0x1d4d17f, ftLastWriteTime.dwLowDateTime=0x5abc7920, ftLastWriteTime.dwHighDateTime=0x1d4d17f, nFileSizeHigh=0x0, nFileSizeLow=0x13e41, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MMi5QrXUI1_xiW.xlsx", cAlternateFileName="MMI5QR~1.XLS")) returned 1 [0052.621] lstrcmpiW (lpString1="MMi5QrXUI1_xiW.xlsx", lpString2=".") returned 1 [0052.621] lstrcmpiW (lpString1="MMi5QrXUI1_xiW.xlsx", lpString2="..") returned 1 [0052.621] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="MMi5QrXUI1_xiW.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx" [0052.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MMi5QrXUI1_xiW.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0052.622] GetProcessHeap () returned 0x560000 [0052.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5769f8 [0052.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MMi5QrXUI1_xiW.xlsx", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MMi5QrXUI1_xiW.xlsx", lpUsedDefaultChar=0x0) returned 20 [0052.622] lstrlenA (lpString="MMi5QrXUI1_xiW.xlsx") returned 19 [0052.622] lstrlenA (lpString=".badday") returned 7 [0052.622] lstrlenA (lpString=".badday") returned 7 [0052.622] lstrlenA (lpString="MMi5QrXUI1_xiW.xlsx") returned 19 [0052.622] lstrcmpiA (lpString1="iW.xlsx", lpString2=".badday") returned 1 [0052.622] lstrcmpiW (lpString1="MMi5QrXUI1_xiW.xlsx", lpString2="how_to_back_files.html") returned 1 [0052.622] lstrcmpiW (lpString1="MMi5QrXUI1_xiW.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.622] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.622] lstrcmpiW (lpString1="MMi5QrXUI1_xiW.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.622] GetProcessHeap () returned 0x560000 [0052.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0052.622] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\mmi5qrxui1_xiw.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.622] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81473) returned 1 [0052.622] GetProcessHeap () returned 0x560000 [0052.622] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.623] GetProcessHeap () returned 0x560000 [0052.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586600 [0052.623] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx") returned 65 [0052.623] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.623] GetProcessHeap () returned 0x560000 [0052.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.623] GetProcessHeap () returned 0x560000 [0052.623] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x584340 [0052.623] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.623] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x587458) returned 1 [0052.625] CryptGenRandom (in: hProv=0x587458, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.625] CryptReleaseContext (hProv=0x587458, dwFlags=0x0) returned 1 [0052.625] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586688 [0052.625] lstrlenA (lpString="010001") returned 6 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5869b8 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fac8 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869b8 | out: hHeap=0x560000) returned 1 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ffd8 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1450 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2058 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2288 [0052.625] GetProcessHeap () returned 0x560000 [0052.625] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587128 [0052.625] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a19c8 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0188 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587128 | out: hHeap=0x560000) returned 1 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1ae0 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0188 | out: hHeap=0x560000) returned 1 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4220 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fb58 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4220 | out: hHeap=0x560000) returned 1 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb58 | out: hHeap=0x560000) returned 1 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.626] GetProcessHeap () returned 0x560000 [0052.626] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.627] GetProcessHeap () returned 0x560000 [0052.627] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.628] GetProcessHeap () returned 0x560000 [0052.628] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.629] GetProcessHeap () returned 0x560000 [0052.629] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.631] GetProcessHeap () returned 0x560000 [0052.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.631] GetProcessHeap () returned 0x560000 [0052.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.631] GetProcessHeap () returned 0x560000 [0052.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.631] GetProcessHeap () returned 0x560000 [0052.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.631] GetProcessHeap () returned 0x560000 [0052.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.631] GetProcessHeap () returned 0x560000 [0052.631] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.632] GetProcessHeap () returned 0x560000 [0052.632] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.632] GetProcessHeap () returned 0x560000 [0052.633] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2288 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffd8 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2058 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.633] GetProcessHeap () returned 0x560000 [0052.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586688 | out: hHeap=0x560000) returned 1 [0052.633] WriteFile (in: hFile=0x230, lpBuffer=0x584340*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x584340*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.717] GetProcessHeap () returned 0x560000 [0052.717] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x584340, Size=0x30) returned 0x584340 [0052.717] GetProcessHeap () returned 0x560000 [0052.717] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.717] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.717] GetProcessHeap () returned 0x560000 [0052.717] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13e41) returned 0x5a7240 [0052.719] ReadFile (in: hFile=0x230, lpBuffer=0x5a7240, nNumberOfBytesToRead=0x13e41, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7240*, lpNumberOfBytesRead=0x24ad7e8*=0x13e41, lpOverlapped=0x0) returned 1 [0052.720] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.720] WriteFile (in: hFile=0x230, lpBuffer=0x5a7240*, nNumberOfBytesToWrite=0x13e41, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7240*, lpNumberOfBytesWritten=0x24ad7e4*=0x13e41, lpOverlapped=0x0) returned 1 [0052.721] GetProcessHeap () returned 0x560000 [0052.721] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7240 | out: hHeap=0x560000) returned 1 [0052.721] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.722] WriteFile (in: hFile=0x230, lpBuffer=0x584340*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x584340*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.722] CloseHandle (hObject=0x230) returned 1 [0052.723] GetProcessHeap () returned 0x560000 [0052.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0052.723] GetProcessHeap () returned 0x560000 [0052.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.723] GetProcessHeap () returned 0x560000 [0052.723] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0052.723] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx" [0052.723] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx.badday" [0052.723] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\mmi5qrxui1_xiw.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\mmi5qrxui1_xiw.xlsx.badday"), dwFlags=0x1) returned 1 [0052.724] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\MMi5QrXUI1_xiW.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z") returned 1 [0052.724] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="" [0052.724] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" [0052.724] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\how_to_back_files.html")) returned 0x20 [0052.724] GetProcessHeap () returned 0x560000 [0052.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0052.724] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82283ca0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0x1f2cf9e0, ftLastAccessTime.dwHighDateTime=0x1d4cff7, ftLastWriteTime.dwLowDateTime=0x1f2cf9e0, ftLastWriteTime.dwHighDateTime=0x1d4cff7, nFileSizeHigh=0x0, nFileSizeLow=0x13762, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R-ElWaAxmt4rcwz.xlsx", cAlternateFileName="R-ELWA~1.XLS")) returned 1 [0052.724] lstrcmpiW (lpString1="R-ElWaAxmt4rcwz.xlsx", lpString2=".") returned 1 [0052.724] lstrcmpiW (lpString1="R-ElWaAxmt4rcwz.xlsx", lpString2="..") returned 1 [0052.724] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="R-ElWaAxmt4rcwz.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx" [0052.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R-ElWaAxmt4rcwz.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0052.724] GetProcessHeap () returned 0x560000 [0052.724] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x15) returned 0x576a58 [0052.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R-ElWaAxmt4rcwz.xlsx", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="R-ElWaAxmt4rcwz.xlsx", lpUsedDefaultChar=0x0) returned 21 [0052.724] lstrlenA (lpString="R-ElWaAxmt4rcwz.xlsx") returned 20 [0052.724] lstrlenA (lpString=".badday") returned 7 [0052.724] lstrlenA (lpString=".badday") returned 7 [0052.725] lstrlenA (lpString="R-ElWaAxmt4rcwz.xlsx") returned 20 [0052.725] lstrcmpiA (lpString1="wz.xlsx", lpString2=".badday") returned 1 [0052.725] lstrcmpiW (lpString1="R-ElWaAxmt4rcwz.xlsx", lpString2="how_to_back_files.html") returned 1 [0052.725] lstrcmpiW (lpString1="R-ElWaAxmt4rcwz.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.725] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.725] lstrcmpiW (lpString1="R-ElWaAxmt4rcwz.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.725] GetProcessHeap () returned 0x560000 [0052.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0052.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\r-elwaaxmt4rcwz.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.725] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=79714) returned 1 [0052.725] GetProcessHeap () returned 0x560000 [0052.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.725] GetProcessHeap () returned 0x560000 [0052.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5872c0 [0052.725] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx") returned 66 [0052.725] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.725] GetProcessHeap () returned 0x560000 [0052.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.725] GetProcessHeap () returned 0x560000 [0052.725] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7240 [0052.725] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.725] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586930) returned 1 [0052.726] CryptGenRandom (in: hProv=0x586930, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.726] CryptReleaseContext (hProv=0x586930, dwFlags=0x0) returned 1 [0052.726] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587348 [0052.726] lstrlenA (lpString="010001") returned 6 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5873d0 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f5b8 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5873d0 | out: hHeap=0x560000) returned 1 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0068 [0052.726] GetProcessHeap () returned 0x560000 [0052.726] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a19c8 [0052.726] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a158 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2058 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586e80 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1450 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fbe8 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e80 | out: hHeap=0x560000) returned 1 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1d10 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbe8 | out: hHeap=0x560000) returned 1 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a40d0 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5a0188 [0052.727] GetProcessHeap () returned 0x560000 [0052.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a40d0 | out: hHeap=0x560000) returned 1 [0052.727] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a18b0 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0188 | out: hHeap=0x560000) returned 1 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.728] GetProcessHeap () returned 0x560000 [0052.728] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.729] GetProcessHeap () returned 0x560000 [0052.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.730] GetProcessHeap () returned 0x560000 [0052.730] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.731] GetProcessHeap () returned 0x560000 [0052.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.733] GetProcessHeap () returned 0x560000 [0052.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.733] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2058 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d10 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a18b0 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0068 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5b8 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.734] GetProcessHeap () returned 0x560000 [0052.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587348 | out: hHeap=0x560000) returned 1 [0052.734] WriteFile (in: hFile=0x230, lpBuffer=0x5a7240*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7240*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.736] GetProcessHeap () returned 0x560000 [0052.736] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7240, Size=0x30) returned 0x5a7240 [0052.736] GetProcessHeap () returned 0x560000 [0052.736] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.736] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.737] GetProcessHeap () returned 0x560000 [0052.737] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x13762) returned 0x5a7278 [0052.737] ReadFile (in: hFile=0x230, lpBuffer=0x5a7278, nNumberOfBytesToRead=0x13762, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7278*, lpNumberOfBytesRead=0x24ad7e8*=0x13762, lpOverlapped=0x0) returned 1 [0052.738] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.738] WriteFile (in: hFile=0x230, lpBuffer=0x5a7278*, nNumberOfBytesToWrite=0x13762, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7278*, lpNumberOfBytesWritten=0x24ad7e4*=0x13762, lpOverlapped=0x0) returned 1 [0052.739] GetProcessHeap () returned 0x560000 [0052.739] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7278 | out: hHeap=0x560000) returned 1 [0052.740] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.740] WriteFile (in: hFile=0x230, lpBuffer=0x5a7240*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7240*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.741] CloseHandle (hObject=0x230) returned 1 [0052.742] GetProcessHeap () returned 0x560000 [0052.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0052.742] GetProcessHeap () returned 0x560000 [0052.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.742] GetProcessHeap () returned 0x560000 [0052.742] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5872c0 | out: hHeap=0x560000) returned 1 [0052.742] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx" [0052.742] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx.badday" [0052.742] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\r-elwaaxmt4rcwz.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\r-elwaaxmt4rcwz.xlsx.badday"), dwFlags=0x1) returned 1 [0052.742] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\R-ElWaAxmt4rcwz.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z") returned 1 [0052.742] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="" [0052.742] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" [0052.742] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\how_to_back_files.html")) returned 0x20 [0052.743] GetProcessHeap () returned 0x560000 [0052.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0052.743] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b75520, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x50c41980, ftLastAccessTime.dwHighDateTime=0x1d4c7f9, ftLastWriteTime.dwLowDateTime=0x50c41980, ftLastWriteTime.dwHighDateTime=0x1d4c7f9, nFileSizeHigh=0x0, nFileSizeLow=0x33ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VDSSm2U6VHQHnhOObZju.odt", cAlternateFileName="VDSSM2~1.ODT")) returned 1 [0052.743] lstrcmpiW (lpString1="VDSSm2U6VHQHnhOObZju.odt", lpString2=".") returned 1 [0052.743] lstrcmpiW (lpString1="VDSSm2U6VHQHnhOObZju.odt", lpString2="..") returned 1 [0052.743] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="VDSSm2U6VHQHnhOObZju.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt" [0052.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VDSSm2U6VHQHnhOObZju.odt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0052.743] GetProcessHeap () returned 0x560000 [0052.743] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d530 [0052.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VDSSm2U6VHQHnhOObZju.odt", cchWideChar=-1, lpMultiByteStr=0x57d530, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VDSSm2U6VHQHnhOObZju.odt", lpUsedDefaultChar=0x0) returned 25 [0052.743] lstrlenA (lpString="VDSSm2U6VHQHnhOObZju.odt") returned 24 [0052.743] lstrlenA (lpString=".badday") returned 7 [0052.743] lstrlenA (lpString=".badday") returned 7 [0052.743] lstrlenA (lpString="VDSSm2U6VHQHnhOObZju.odt") returned 24 [0052.743] lstrcmpiA (lpString1="Zju.odt", lpString2=".badday") returned 1 [0052.743] lstrcmpiW (lpString1="VDSSm2U6VHQHnhOObZju.odt", lpString2="how_to_back_files.html") returned 1 [0052.743] lstrcmpiW (lpString1="VDSSm2U6VHQHnhOObZju.odt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.743] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.743] lstrcmpiW (lpString1="VDSSm2U6VHQHnhOObZju.odt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0052.743] GetProcessHeap () returned 0x560000 [0052.743] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1c0 [0052.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\vdssm2u6vhqhnhoobzju.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.743] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=13294) returned 1 [0052.743] GetProcessHeap () returned 0x560000 [0052.743] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.743] GetProcessHeap () returned 0x560000 [0052.743] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586688 [0052.743] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt") returned 70 [0052.744] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.744] GetProcessHeap () returned 0x560000 [0052.744] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.744] GetProcessHeap () returned 0x560000 [0052.744] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7278 [0052.745] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.745] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x587018) returned 1 [0052.745] CryptGenRandom (in: hProv=0x587018, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.745] CryptReleaseContext (hProv=0x587018, dwFlags=0x0) returned 1 [0052.745] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.745] GetProcessHeap () returned 0x560000 [0052.745] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5871b0 [0052.745] lstrlenA (lpString="010001") returned 6 [0052.745] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587128 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f648 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587128 | out: hHeap=0x560000) returned 1 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fbe8 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a2170 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a19c8 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a18b0 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586d70 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1ae0 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fe28 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d70 | out: hHeap=0x560000) returned 1 [0052.746] GetProcessHeap () returned 0x560000 [0052.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fe28 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a4298 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59ffd8 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a4298 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1798 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffd8 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.747] GetProcessHeap () returned 0x560000 [0052.747] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.747] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.748] GetProcessHeap () returned 0x560000 [0052.748] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.749] GetProcessHeap () returned 0x560000 [0052.749] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.749] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.750] GetProcessHeap () returned 0x560000 [0052.750] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.750] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a18b0 | out: hHeap=0x560000) returned 1 [0052.751] GetProcessHeap () returned 0x560000 [0052.751] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1798 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbe8 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2170 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f648 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.752] GetProcessHeap () returned 0x560000 [0052.752] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871b0 | out: hHeap=0x560000) returned 1 [0052.752] WriteFile (in: hFile=0x230, lpBuffer=0x5a7278*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7278*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.754] GetProcessHeap () returned 0x560000 [0052.754] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7278, Size=0x30) returned 0x5a7278 [0052.754] GetProcessHeap () returned 0x560000 [0052.754] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.754] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.754] GetProcessHeap () returned 0x560000 [0052.754] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x33ee) returned 0x5a72b0 [0052.755] ReadFile (in: hFile=0x230, lpBuffer=0x5a72b0, nNumberOfBytesToRead=0x33ee, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a72b0*, lpNumberOfBytesRead=0x24ad7e8*=0x33ee, lpOverlapped=0x0) returned 1 [0052.755] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.755] WriteFile (in: hFile=0x230, lpBuffer=0x5a72b0*, nNumberOfBytesToWrite=0x33ee, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a72b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x33ee, lpOverlapped=0x0) returned 1 [0052.756] GetProcessHeap () returned 0x560000 [0052.756] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a72b0 | out: hHeap=0x560000) returned 1 [0052.756] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.756] WriteFile (in: hFile=0x230, lpBuffer=0x5a7278*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7278*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.757] CloseHandle (hObject=0x230) returned 1 [0052.757] GetProcessHeap () returned 0x560000 [0052.757] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1c0 | out: hHeap=0x560000) returned 1 [0052.757] GetProcessHeap () returned 0x560000 [0052.758] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.758] GetProcessHeap () returned 0x560000 [0052.758] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586688 | out: hHeap=0x560000) returned 1 [0052.758] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt" [0052.758] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt.badday") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt.badday" [0052.758] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\vdssm2u6vhqhnhoobzju.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt.badday" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\vdssm2u6vhqhnhoobzju.odt.badday"), dwFlags=0x1) returned 1 [0052.758] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\VDSSm2U6VHQHnhOObZju.odt" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z") returned 1 [0052.758] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="" [0052.758] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" [0052.758] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\how_to_back_files.html")) returned 0x20 [0052.758] GetProcessHeap () returned 0x560000 [0052.758] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d530 | out: hHeap=0x560000) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6698d880, ftCreationTime.dwHighDateTime=0x1d4c8d1, ftLastAccessTime.dwLowDateTime=0x3fadc9c0, ftLastAccessTime.dwHighDateTime=0x1d4d352, ftLastWriteTime.dwLowDateTime=0x3fadc9c0, ftLastWriteTime.dwHighDateTime=0x1d4d352, nFileSizeHigh=0x0, nFileSizeLow=0x1168b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_ivmwfEJTOYefILm1Bb7.ods", cAlternateFileName="_IVMWF~1.ODS")) returned 1 [0052.758] lstrcmpiW (lpString1="_ivmwfEJTOYefILm1Bb7.ods", lpString2=".") returned 1 [0052.758] lstrcmpiW (lpString1="_ivmwfEJTOYefILm1Bb7.ods", lpString2="..") returned 1 [0052.759] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="_ivmwfEJTOYefILm1Bb7.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods" [0052.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_ivmwfEJTOYefILm1Bb7.ods", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0052.759] GetProcessHeap () returned 0x560000 [0052.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x19) returned 0x57d1e8 [0052.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_ivmwfEJTOYefILm1Bb7.ods", cchWideChar=-1, lpMultiByteStr=0x57d1e8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ivmwfEJTOYefILm1Bb7.ods", lpUsedDefaultChar=0x0) returned 25 [0052.759] lstrlenA (lpString="_ivmwfEJTOYefILm1Bb7.ods") returned 24 [0052.759] lstrlenA (lpString=".badday") returned 7 [0052.759] lstrlenA (lpString=".badday") returned 7 [0052.759] lstrlenA (lpString="_ivmwfEJTOYefILm1Bb7.ods") returned 24 [0052.759] lstrcmpiA (lpString1="Bb7.ods", lpString2=".badday") returned 1 [0052.759] lstrcmpiW (lpString1="_ivmwfEJTOYefILm1Bb7.ods", lpString2="how_to_back_files.html") returned -1 [0052.759] lstrcmpiW (lpString1="_ivmwfEJTOYefILm1Bb7.ods", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0052.759] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.759] lstrcmpiW (lpString1="_ivmwfEJTOYefILm1Bb7.ods", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.759] GetProcessHeap () returned 0x560000 [0052.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0052.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\_ivmwfejtoyefilm1bb7.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.759] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=71307) returned 1 [0052.759] GetProcessHeap () returned 0x560000 [0052.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.759] GetProcessHeap () returned 0x560000 [0052.759] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586b50 [0052.760] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods") returned 70 [0052.760] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.760] GetProcessHeap () returned 0x560000 [0052.760] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.760] GetProcessHeap () returned 0x560000 [0052.760] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x385) returned 0x5a72b0 [0052.760] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.760] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586c60) returned 1 [0052.760] CryptGenRandom (in: hProv=0x586c60, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.760] CryptReleaseContext (hProv=0x586c60, dwFlags=0x0) returned 1 [0052.760] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.760] GetProcessHeap () returned 0x560000 [0052.760] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586bd8 [0052.760] lstrlenA (lpString="010001") returned 6 [0052.760] GetProcessHeap () returned 0x560000 [0052.760] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586c60 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fbe8 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c60 | out: hHeap=0x560000) returned 1 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ff48 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1450 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1568 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1ae0 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586f08 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1f40 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fd08 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f08 | out: hHeap=0x560000) returned 1 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1d10 [0052.761] GetProcessHeap () returned 0x560000 [0052.761] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd08 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a41c0 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5a02a8 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a41c0 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1680 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.762] GetProcessHeap () returned 0x560000 [0052.762] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.762] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.763] GetProcessHeap () returned 0x560000 [0052.763] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.763] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.764] GetProcessHeap () returned 0x560000 [0052.764] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.765] GetProcessHeap () returned 0x560000 [0052.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0052.766] GetProcessHeap () returned 0x560000 [0052.766] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d10 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f40 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1680 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff48 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbe8 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1568 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.767] GetProcessHeap () returned 0x560000 [0052.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586bd8 | out: hHeap=0x560000) returned 1 [0052.767] WriteFile (in: hFile=0x230, lpBuffer=0x5a72b0*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a72b0*, lpNumberOfBytesWritten=0x24ad864*=0x385, lpOverlapped=0x0) returned 1 [0052.769] GetProcessHeap () returned 0x560000 [0052.769] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a72b0, Size=0x30) returned 0x5a72b0 [0052.769] GetProcessHeap () returned 0x560000 [0052.769] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.769] GetProcessHeap () returned 0x560000 [0052.769] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11690) returned 0x5a72e8 [0052.770] ReadFile (in: hFile=0x230, lpBuffer=0x5a72e8, nNumberOfBytesToRead=0x11690, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a72e8*, lpNumberOfBytesRead=0x24ad7e8*=0x11690, lpOverlapped=0x0) returned 1 [0052.771] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.771] WriteFile (in: hFile=0x230, lpBuffer=0x5a72e8*, nNumberOfBytesToWrite=0x11690, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a72e8*, lpNumberOfBytesWritten=0x24ad7e4*=0x11690, lpOverlapped=0x0) returned 1 [0052.772] GetProcessHeap () returned 0x560000 [0052.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a72e8 | out: hHeap=0x560000) returned 1 [0052.774] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.774] WriteFile (in: hFile=0x230, lpBuffer=0x5a72b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a72b0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.775] CloseHandle (hObject=0x230) returned 1 [0052.775] GetProcessHeap () returned 0x560000 [0052.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0052.775] GetProcessHeap () returned 0x560000 [0052.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.775] GetProcessHeap () returned 0x560000 [0052.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b50 | out: hHeap=0x560000) returned 1 [0052.775] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods" [0052.775] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods.badday") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods.badday" [0052.775] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\_ivmwfejtoyefilm1bb7.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods.badday" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\_ivmwfejtoyefilm1bb7.ods.badday"), dwFlags=0x1) returned 1 [0052.776] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\_ivmwfEJTOYefILm1Bb7.ods" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z") returned 1 [0052.776] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\") returned="" [0052.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" [0052.776] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XxvpkL3pzhyiXpEsq5Z\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\xxvpkl3pzhyixpesq5z\\how_to_back_files.html")) returned 0x20 [0052.776] GetProcessHeap () returned 0x560000 [0052.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1e8 | out: hHeap=0x560000) returned 1 [0052.776] FindNextFileW (in: hFindFile=0x579888, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6698d880, ftCreationTime.dwHighDateTime=0x1d4c8d1, ftLastAccessTime.dwLowDateTime=0x3fadc9c0, ftLastAccessTime.dwHighDateTime=0x1d4d352, ftLastWriteTime.dwLowDateTime=0x3fadc9c0, ftLastWriteTime.dwHighDateTime=0x1d4d352, nFileSizeHigh=0x0, nFileSizeLow=0x1168b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_ivmwfEJTOYefILm1Bb7.ods", cAlternateFileName="_IVMWF~1.ODS")) returned 0 [0052.776] FindClose (in: hFindFile=0x579888 | out: hFindFile=0x579888) returned 1 [0052.776] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0052.776] GetProcessHeap () returned 0x560000 [0052.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589de0 | out: hHeap=0x560000) returned 1 [0052.776] GetProcessHeap () returned 0x560000 [0052.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.777] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned 40 [0052.777] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*" [0052.777] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0052.778] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.778] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.778] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.778] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.778] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0052.778] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2=".") returned 1 [0052.778] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="..") returned 1 [0052.778] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="kkcie@kdj.kd.pst" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0052.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kkcie@kdj.kd.pst", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.778] GetProcessHeap () returned 0x560000 [0052.778] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x11) returned 0x576b18 [0052.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kkcie@kdj.kd.pst", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kkcie@kdj.kd.pst", lpUsedDefaultChar=0x0) returned 17 [0052.778] lstrlenA (lpString="kkcie@kdj.kd.pst") returned 16 [0052.778] lstrlenA (lpString=".badday") returned 7 [0052.778] lstrlenA (lpString=".badday") returned 7 [0052.778] lstrlenA (lpString="kkcie@kdj.kd.pst") returned 16 [0052.778] lstrcmpiA (lpString1=".kd.pst", lpString2=".badday") returned 1 [0052.779] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="how_to_back_files.html") returned 1 [0052.779] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0052.779] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0052.779] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0052.779] GetProcessHeap () returned 0x560000 [0052.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d350 [0052.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.779] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=271360) returned 1 [0052.779] GetProcessHeap () returned 0x560000 [0052.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.779] GetProcessHeap () returned 0x560000 [0052.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587018 [0052.779] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned 56 [0052.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.779] GetProcessHeap () returned 0x560000 [0052.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0052.779] GetProcessHeap () returned 0x560000 [0052.779] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a4070 [0052.779] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.779] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586a40) returned 1 [0052.780] CryptGenRandom (in: hProv=0x586a40, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0052.780] CryptReleaseContext (hProv=0x586a40, dwFlags=0x0) returned 1 [0052.780] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587238 [0052.780] lstrlenA (lpString="010001") returned 6 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586c60 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fb58 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c60 | out: hHeap=0x560000) returned 1 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fc78 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1450 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0052.780] GetProcessHeap () returned 0x560000 [0052.780] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1798 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1f40 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5868a8 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1e28 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f768 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868a8 | out: hHeap=0x560000) returned 1 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1ae0 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f768 | out: hHeap=0x560000) returned 1 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x589e60 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59ffd8 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x589e60 | out: hHeap=0x560000) returned 1 [0052.781] GetProcessHeap () returned 0x560000 [0052.781] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0052.781] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffd8 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.782] GetProcessHeap () returned 0x560000 [0052.782] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.782] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.783] GetProcessHeap () returned 0x560000 [0052.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.783] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.784] GetProcessHeap () returned 0x560000 [0052.784] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.785] GetProcessHeap () returned 0x560000 [0052.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f40 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e28 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc78 | out: hHeap=0x560000) returned 1 [0052.786] GetProcessHeap () returned 0x560000 [0052.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0052.787] GetProcessHeap () returned 0x560000 [0052.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb58 | out: hHeap=0x560000) returned 1 [0052.787] GetProcessHeap () returned 0x560000 [0052.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1798 | out: hHeap=0x560000) returned 1 [0052.787] GetProcessHeap () returned 0x560000 [0052.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0052.787] GetProcessHeap () returned 0x560000 [0052.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587238 | out: hHeap=0x560000) returned 1 [0052.787] WriteFile (in: hFile=0x230, lpBuffer=0x5a4070*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4070*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0052.791] GetProcessHeap () returned 0x560000 [0052.791] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a4070, Size=0x30) returned 0x5a4070 [0052.791] GetProcessHeap () returned 0x560000 [0052.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0052.792] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.792] GetProcessHeap () returned 0x560000 [0052.792] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x42400) returned 0x5a72e8 [0052.797] ReadFile (in: hFile=0x230, lpBuffer=0x5a72e8, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a72e8*, lpNumberOfBytesRead=0x24ad7e8*=0x42400, lpOverlapped=0x0) returned 1 [0052.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.802] WriteFile (in: hFile=0x230, lpBuffer=0x5a72e8*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a72e8*, lpNumberOfBytesWritten=0x24ad7e4*=0x42400, lpOverlapped=0x0) returned 1 [0052.894] GetProcessHeap () returned 0x560000 [0052.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a72e8 | out: hHeap=0x560000) returned 1 [0052.894] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0052.894] WriteFile (in: hFile=0x230, lpBuffer=0x5a4070*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a4070*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0052.895] CloseHandle (hObject=0x230) returned 1 [0052.895] GetProcessHeap () returned 0x560000 [0052.895] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d350 | out: hHeap=0x560000) returned 1 [0052.896] GetProcessHeap () returned 0x560000 [0052.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.896] GetProcessHeap () returned 0x560000 [0052.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587018 | out: hHeap=0x560000) returned 1 [0052.896] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0052.896] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.badday") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.badday" [0052.896] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.badday" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.badday"), dwFlags=0x1) returned 1 [0052.896] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned 1 [0052.896] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="" [0052.896] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\how_to_back_files.html" [0052.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\how_to_back_files.html")) returned 0xffffffff [0052.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0052.897] GetProcessHeap () returned 0x560000 [0052.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.897] GetProcessHeap () returned 0x560000 [0052.897] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586f90 [0052.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.937] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.938] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.939] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.942] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.944] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.945] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.946] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.947] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.948] GetProcessHeap () returned 0x560000 [0052.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0052.948] GetProcessHeap () returned 0x560000 [0052.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f90 | out: hHeap=0x560000) returned 1 [0052.948] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0052.948] GetProcessHeap () returned 0x560000 [0052.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0052.948] GetProcessHeap () returned 0x560000 [0052.948] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5871b0 [0052.954] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.954] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.954] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.955] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.956] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.959] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.960] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.961] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.962] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.009] GetProcessHeap () returned 0x560000 [0053.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.009] GetProcessHeap () returned 0x560000 [0053.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5871b0 | out: hHeap=0x560000) returned 1 [0053.009] CloseHandle (hObject=0x230) returned 1 [0053.009] GetProcessHeap () returned 0x560000 [0053.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576b18 | out: hHeap=0x560000) returned 1 [0053.009] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0053.009] FindClose (in: hFindFile=0x5797c8 | out: hFindFile=0x5797c8) returned 1 [0053.009] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0053.009] GetProcessHeap () returned 0x560000 [0053.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e680 | out: hHeap=0x560000) returned 1 [0053.010] GetProcessHeap () returned 0x560000 [0053.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.010] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned 36 [0053.010] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\*" [0053.010] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0xffffffff [0053.010] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0053.010] GetProcessHeap () returned 0x560000 [0053.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e2b8 | out: hHeap=0x560000) returned 1 [0053.010] GetProcessHeap () returned 0x560000 [0053.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.010] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned 36 [0053.010] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*" [0053.010] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0053.011] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.011] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.011] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.011] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.011] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.011] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.011] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.011] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" [0053.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.011] GetProcessHeap () returned 0x560000 [0053.011] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0053.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0053.011] lstrlenA (lpString="desktop.ini") returned 11 [0053.011] lstrlenA (lpString=".badday") returned 7 [0053.011] lstrlenA (lpString=".badday") returned 7 [0053.012] lstrlenA (lpString="desktop.ini") returned 11 [0053.012] lstrcmpiA (lpString1="top.ini", lpString2=".badday") returned 1 [0053.012] lstrcmpiW (lpString1="desktop.ini", lpString2="how_to_back_files.html") returned -1 [0053.012] lstrcmpiW (lpString1="desktop.ini", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.012] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.012] lstrcmpiW (lpString1="desktop.ini", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.012] GetProcessHeap () returned 0x560000 [0053.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0053.012] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.012] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=216) returned 1 [0053.012] GetProcessHeap () returned 0x560000 [0053.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.012] GetProcessHeap () returned 0x560000 [0053.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586d70 [0053.012] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned 47 [0053.012] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.012] GetProcessHeap () returned 0x560000 [0053.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.012] GetProcessHeap () returned 0x560000 [0053.012] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x388) returned 0x5a40a8 [0053.012] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.012] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586820) returned 1 [0053.013] CryptGenRandom (in: hProv=0x586820, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.013] CryptReleaseContext (hProv=0x586820, dwFlags=0x0) returned 1 [0053.013] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ac8 [0053.013] lstrlenA (lpString="010001") returned 6 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a198 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586df8 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f5b8 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586df8 | out: hHeap=0x560000) returned 1 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fc78 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1568 [0053.013] GetProcessHeap () returned 0x560000 [0053.013] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a1b8 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a19c8 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2058 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5868a8 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a2288 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7600 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f498 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868a8 | out: hHeap=0x560000) returned 1 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2170 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f498 | out: hHeap=0x560000) returned 1 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a75a0 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fe28 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a75a0 | out: hHeap=0x560000) returned 1 [0053.014] GetProcessHeap () returned 0x560000 [0053.014] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a18b0 [0053.014] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fe28 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.015] GetProcessHeap () returned 0x560000 [0053.015] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.016] GetProcessHeap () returned 0x560000 [0053.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.016] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.017] GetProcessHeap () returned 0x560000 [0053.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.017] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.018] GetProcessHeap () returned 0x560000 [0053.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2058 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2170 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2288 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a18b0 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7600 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc78 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1568 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5b8 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.019] GetProcessHeap () returned 0x560000 [0053.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ac8 | out: hHeap=0x560000) returned 1 [0053.019] WriteFile (in: hFile=0x230, lpBuffer=0x5a40a8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a40a8*, lpNumberOfBytesWritten=0x24ad864*=0x388, lpOverlapped=0x0) returned 1 [0053.023] GetProcessHeap () returned 0x560000 [0053.023] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a40a8, Size=0x30) returned 0x5a40a8 [0053.023] GetProcessHeap () returned 0x560000 [0053.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.023] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.023] GetProcessHeap () returned 0x560000 [0053.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe0) returned 0x5728f8 [0053.023] ReadFile (in: hFile=0x230, lpBuffer=0x5728f8, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5728f8*, lpNumberOfBytesRead=0x24ad7e8*=0xe0, lpOverlapped=0x0) returned 1 [0053.023] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.023] WriteFile (in: hFile=0x230, lpBuffer=0x5728f8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5728f8*, lpNumberOfBytesWritten=0x24ad7e4*=0xe0, lpOverlapped=0x0) returned 1 [0053.024] GetProcessHeap () returned 0x560000 [0053.024] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5728f8 | out: hHeap=0x560000) returned 1 [0053.024] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.024] WriteFile (in: hFile=0x230, lpBuffer=0x5a40a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a40a8*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.025] CloseHandle (hObject=0x230) returned 1 [0053.026] GetProcessHeap () returned 0x560000 [0053.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0053.026] GetProcessHeap () returned 0x560000 [0053.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.026] GetProcessHeap () returned 0x560000 [0053.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d70 | out: hHeap=0x560000) returned 1 [0053.026] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" [0053.026] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.badday") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.badday" [0053.026] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.badday" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.badday"), dwFlags=0x1) returned 1 [0053.026] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned 1 [0053.026] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="" [0053.026] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\how_to_back_files.html" [0053.026] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\how_to_back_files.html")) returned 0xffffffff [0053.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0053.028] GetProcessHeap () returned 0x560000 [0053.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.028] GetProcessHeap () returned 0x560000 [0053.028] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586710 [0053.034] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.038] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.039] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.041] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.056] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.067] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.068] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.068] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.068] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.068] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.068] GetProcessHeap () returned 0x560000 [0053.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.068] GetProcessHeap () returned 0x560000 [0053.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586710 | out: hHeap=0x560000) returned 1 [0053.068] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0053.068] GetProcessHeap () returned 0x560000 [0053.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.068] GetProcessHeap () returned 0x560000 [0053.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586b50 [0053.074] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.076] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.077] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.083] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.083] GetProcessHeap () returned 0x560000 [0053.083] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.083] GetProcessHeap () returned 0x560000 [0053.083] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b50 | out: hHeap=0x560000) returned 1 [0053.083] CloseHandle (hObject=0x230) returned 1 [0053.083] GetProcessHeap () returned 0x560000 [0053.083] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.083] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0053.083] lstrcmpiW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0053.083] lstrcmpiW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0053.083] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="Favorites.vssx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" [0053.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0053.083] GetProcessHeap () returned 0x560000 [0053.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xf) returned 0x57ec40 [0053.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites.vssx", lpUsedDefaultChar=0x0) returned 15 [0053.084] lstrlenA (lpString="Favorites.vssx") returned 14 [0053.084] lstrlenA (lpString=".badday") returned 7 [0053.084] lstrlenA (lpString=".badday") returned 7 [0053.084] lstrlenA (lpString="Favorites.vssx") returned 14 [0053.084] lstrcmpiA (lpString1="es.vssx", lpString2=".badday") returned 1 [0053.084] lstrcmpiW (lpString1="Favorites.vssx", lpString2="how_to_back_files.html") returned -1 [0053.084] lstrcmpiW (lpString1="Favorites.vssx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.084] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.084] lstrcmpiW (lpString1="Favorites.vssx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.084] GetProcessHeap () returned 0x560000 [0053.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0053.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.084] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=0) returned 1 [0053.084] CloseHandle (hObject=0x230) returned 1 [0053.084] GetProcessHeap () returned 0x560000 [0053.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d620 | out: hHeap=0x560000) returned 1 [0053.084] GetProcessHeap () returned 0x560000 [0053.084] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.084] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0053.084] lstrcmpiW (lpString1="_private", lpString2=".") returned 1 [0053.084] lstrcmpiW (lpString1="_private", lpString2="..") returned 1 [0053.084] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0053.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_private", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.084] GetProcessHeap () returned 0x560000 [0053.084] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x9) returned 0x57ec40 [0053.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_private", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_private", lpUsedDefaultChar=0x0) returned 9 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0053.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0053.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0053.086] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0053.086] GetProcessHeap () returned 0x560000 [0053.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0f8 [0053.086] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned 45 [0053.086] GetProcessHeap () returned 0x560000 [0053.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5c) returned 0x572a40 [0053.086] lstrcpyW (in: lpString1=0x572a40, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0053.086] GetProcessHeap () returned 0x560000 [0053.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.086] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0053.086] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0053.086] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0053.086] GetProcessHeap () returned 0x560000 [0053.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x572a40 | out: hHeap=0x560000) returned 1 [0053.086] GetProcessHeap () returned 0x560000 [0053.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.087] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned 45 [0053.087] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*" [0053.087] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0053.123] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.123] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.123] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.123] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.123] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0053.123] lstrcmpiW (lpString1="folder.ico", lpString2=".") returned 1 [0053.123] lstrcmpiW (lpString1="folder.ico", lpString2="..") returned 1 [0053.123] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="folder.ico" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" [0053.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.123] GetProcessHeap () returned 0x560000 [0053.123] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb) returned 0x57ec40 [0053.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="folder.ico", lpUsedDefaultChar=0x0) returned 11 [0053.124] lstrlenA (lpString="folder.ico") returned 10 [0053.124] lstrlenA (lpString=".badday") returned 7 [0053.124] lstrlenA (lpString=".badday") returned 7 [0053.124] lstrlenA (lpString="folder.ico") returned 10 [0053.124] lstrcmpiA (lpString1="der.ico", lpString2=".badday") returned 1 [0053.124] lstrcmpiW (lpString1="folder.ico", lpString2="how_to_back_files.html") returned -1 [0053.124] lstrcmpiW (lpString1="folder.ico", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.124] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.124] lstrcmpiW (lpString1="folder.ico", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.124] GetProcessHeap () returned 0x560000 [0053.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d148 [0053.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.124] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=29926) returned 1 [0053.124] GetProcessHeap () returned 0x560000 [0053.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.124] GetProcessHeap () returned 0x560000 [0053.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586600 [0053.124] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned 55 [0053.124] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.124] GetProcessHeap () returned 0x560000 [0053.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.124] GetProcessHeap () returned 0x560000 [0053.124] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a40e0 [0053.124] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.125] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586710) returned 1 [0053.125] CryptGenRandom (in: hProv=0x586710, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.125] CryptReleaseContext (hProv=0x586710, dwFlags=0x0) returned 1 [0053.125] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.125] GetProcessHeap () returned 0x560000 [0053.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586688 [0053.125] lstrlenA (lpString="010001") returned 6 [0053.125] GetProcessHeap () returned 0x560000 [0053.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0053.125] GetProcessHeap () returned 0x560000 [0053.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5869b8 [0053.125] GetProcessHeap () returned 0x560000 [0053.125] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fc78 [0053.125] GetProcessHeap () returned 0x560000 [0053.125] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869b8 | out: hHeap=0x560000) returned 1 [0053.125] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fd08 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1450 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1568 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1ae0 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587238 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1bf8 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a73f0 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ffd8 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587238 | out: hHeap=0x560000) returned 1 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1798 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ffd8 | out: hHeap=0x560000) returned 1 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7558 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.126] GetProcessHeap () returned 0x560000 [0053.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.126] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fac8 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7558 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a18b0 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.127] GetProcessHeap () returned 0x560000 [0053.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.127] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.128] GetProcessHeap () returned 0x560000 [0053.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.129] GetProcessHeap () returned 0x560000 [0053.129] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.130] GetProcessHeap () returned 0x560000 [0053.130] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1798 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a18b0 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a73f0 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd08 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc78 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1568 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.131] GetProcessHeap () returned 0x560000 [0053.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586688 | out: hHeap=0x560000) returned 1 [0053.131] WriteFile (in: hFile=0x230, lpBuffer=0x5a40e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a40e0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.137] GetProcessHeap () returned 0x560000 [0053.137] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a40e0, Size=0x30) returned 0x5a40e0 [0053.137] GetProcessHeap () returned 0x560000 [0053.137] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.137] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.137] GetProcessHeap () returned 0x560000 [0053.137] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x74e6) returned 0x5a76f0 [0053.137] ReadFile (in: hFile=0x230, lpBuffer=0x5a76f0, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a76f0*, lpNumberOfBytesRead=0x24ad7e8*=0x74e6, lpOverlapped=0x0) returned 1 [0053.138] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.138] WriteFile (in: hFile=0x230, lpBuffer=0x5a76f0*, nNumberOfBytesToWrite=0x74e6, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a76f0*, lpNumberOfBytesWritten=0x24ad7e4*=0x74e6, lpOverlapped=0x0) returned 1 [0053.139] GetProcessHeap () returned 0x560000 [0053.139] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a76f0 | out: hHeap=0x560000) returned 1 [0053.139] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.139] WriteFile (in: hFile=0x230, lpBuffer=0x5a40e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a40e0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.140] CloseHandle (hObject=0x230) returned 1 [0053.140] GetProcessHeap () returned 0x560000 [0053.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d148 | out: hHeap=0x560000) returned 1 [0053.140] GetProcessHeap () returned 0x560000 [0053.140] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.141] GetProcessHeap () returned 0x560000 [0053.141] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0053.141] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" [0053.141] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.badday") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.badday" [0053.141] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.badday" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.badday"), dwFlags=0x1) returned 1 [0053.141] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned 1 [0053.141] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="" [0053.141] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\how_to_back_files.html" [0053.141] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\how_to_back_files.html")) returned 0xffffffff [0053.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0053.142] GetProcessHeap () returned 0x560000 [0053.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.142] GetProcessHeap () returned 0x560000 [0053.142] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586600 [0053.148] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.149] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.149] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.149] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.149] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.149] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.150] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.151] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.152] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.157] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.158] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.159] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.160] GetProcessHeap () returned 0x560000 [0053.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.160] GetProcessHeap () returned 0x560000 [0053.160] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0053.160] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0053.160] GetProcessHeap () returned 0x560000 [0053.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.160] GetProcessHeap () returned 0x560000 [0053.160] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ac8 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.167] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.168] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.169] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.170] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.171] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.172] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.174] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.175] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.176] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.176] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.176] GetProcessHeap () returned 0x560000 [0053.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.176] GetProcessHeap () returned 0x560000 [0053.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ac8 | out: hHeap=0x560000) returned 1 [0053.176] CloseHandle (hObject=0x230) returned 1 [0053.176] GetProcessHeap () returned 0x560000 [0053.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.176] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0053.176] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0053.176] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0053.176] GetProcessHeap () returned 0x560000 [0053.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e418 | out: hHeap=0x560000) returned 1 [0053.176] GetProcessHeap () returned 0x560000 [0053.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.177] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned 38 [0053.177] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*" [0053.177] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0xffffffff [0053.177] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0053.177] GetProcessHeap () returned 0x560000 [0053.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x585b40 | out: hHeap=0x560000) returned 1 [0053.177] GetProcessHeap () returned 0x560000 [0053.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.177] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned 35 [0053.177] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\*" [0053.177] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0xffffffff [0053.177] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\" [0053.177] GetProcessHeap () returned 0x560000 [0053.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58e310 | out: hHeap=0x560000) returned 1 [0053.177] GetProcessHeap () returned 0x560000 [0053.177] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.177] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned 37 [0053.177] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\*") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\*" [0053.177] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f809fb0, ftCreationTime.dwHighDateTime=0x1d4d12a, ftLastAccessTime.dwLowDateTime=0x67916cb0, ftLastAccessTime.dwHighDateTime=0x1d4c689, ftLastWriteTime.dwLowDateTime=0x67916cb0, ftLastWriteTime.dwHighDateTime=0x1d4c689, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x579448 [0053.177] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.177] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f809fb0, ftCreationTime.dwHighDateTime=0x1d4d12a, ftLastAccessTime.dwLowDateTime=0x67916cb0, ftLastAccessTime.dwHighDateTime=0x1d4c689, ftLastWriteTime.dwLowDateTime=0x67916cb0, ftLastWriteTime.dwHighDateTime=0x1d4c689, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.177] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.178] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.178] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd21fc40, ftCreationTime.dwHighDateTime=0x1d4ce29, ftLastAccessTime.dwLowDateTime=0x55690cc0, ftLastAccessTime.dwHighDateTime=0x1d4c786, ftLastWriteTime.dwLowDateTime=0x55690cc0, ftLastWriteTime.dwHighDateTime=0x1d4c786, nFileSizeHigh=0x0, nFileSizeLow=0x2735, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B7SWmi8Dsm.xlsx", cAlternateFileName="B7SWMI~1.XLS")) returned 1 [0053.178] lstrcmpiW (lpString1="B7SWmi8Dsm.xlsx", lpString2=".") returned 1 [0053.178] lstrcmpiW (lpString1="B7SWmi8Dsm.xlsx", lpString2="..") returned 1 [0053.178] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="B7SWmi8Dsm.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx" [0053.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B7SWmi8Dsm.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0053.178] GetProcessHeap () returned 0x560000 [0053.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x57ec40 [0053.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B7SWmi8Dsm.xlsx", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B7SWmi8Dsm.xlsx", lpUsedDefaultChar=0x0) returned 16 [0053.178] lstrlenA (lpString="B7SWmi8Dsm.xlsx") returned 15 [0053.178] lstrlenA (lpString=".badday") returned 7 [0053.178] lstrlenA (lpString=".badday") returned 7 [0053.178] lstrlenA (lpString="B7SWmi8Dsm.xlsx") returned 15 [0053.178] lstrcmpiA (lpString1="sm.xlsx", lpString2=".badday") returned 1 [0053.178] lstrcmpiW (lpString1="B7SWmi8Dsm.xlsx", lpString2="how_to_back_files.html") returned -1 [0053.178] lstrcmpiW (lpString1="B7SWmi8Dsm.xlsx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.178] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.178] lstrcmpiW (lpString1="B7SWmi8Dsm.xlsx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.178] GetProcessHeap () returned 0x560000 [0053.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d238 [0053.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\b7swmi8dsm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.178] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=10037) returned 1 [0053.178] GetProcessHeap () returned 0x560000 [0053.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.178] GetProcessHeap () returned 0x560000 [0053.178] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586710 [0053.178] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx") returned 52 [0053.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.179] GetProcessHeap () returned 0x560000 [0053.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.179] GetProcessHeap () returned 0x560000 [0053.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a76f0 [0053.179] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.179] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586ac8) returned 1 [0053.179] CryptGenRandom (in: hProv=0x586ac8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.179] CryptReleaseContext (hProv=0x586ac8, dwFlags=0x0) returned 1 [0053.179] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.179] GetProcessHeap () returned 0x560000 [0053.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ac8 [0053.179] lstrlenA (lpString="010001") returned 6 [0053.179] GetProcessHeap () returned 0x560000 [0053.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0053.179] GetProcessHeap () returned 0x560000 [0053.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586798 [0053.179] GetProcessHeap () returned 0x560000 [0053.179] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f9a8 [0053.179] GetProcessHeap () returned 0x560000 [0053.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586798 | out: hHeap=0x560000) returned 1 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fd98 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1ae0 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a118 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a19c8 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586820 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1d10 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a75b8 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f528 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586820 | out: hHeap=0x560000) returned 1 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2058 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f528 | out: hHeap=0x560000) returned 1 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7600 [0053.180] GetProcessHeap () returned 0x560000 [0053.180] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.180] GetProcessHeap () returned 0x560000 [0053.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fa38 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7600 | out: hHeap=0x560000) returned 1 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1450 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa38 | out: hHeap=0x560000) returned 1 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.181] GetProcessHeap () returned 0x560000 [0053.181] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.181] GetProcessHeap () returned 0x560000 [0053.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.221] GetProcessHeap () returned 0x560000 [0053.223] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.223] GetProcessHeap () returned 0x560000 [0053.228] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.234] GetProcessHeap () returned 0x560000 [0053.234] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.235] GetProcessHeap () returned 0x560000 [0053.235] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.235] GetProcessHeap () returned 0x560000 [0053.238] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.238] GetProcessHeap () returned 0x560000 [0053.241] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.243] GetProcessHeap () returned 0x560000 [0053.243] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.249] GetProcessHeap () returned 0x560000 [0053.253] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.256] GetProcessHeap () returned 0x560000 [0053.256] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.257] GetProcessHeap () returned 0x560000 [0053.257] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.257] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.258] GetProcessHeap () returned 0x560000 [0053.258] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2058 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d10 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a75b8 | out: hHeap=0x560000) returned 1 [0053.259] GetProcessHeap () returned 0x560000 [0053.259] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fd98 | out: hHeap=0x560000) returned 1 [0053.260] GetProcessHeap () returned 0x560000 [0053.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0053.260] GetProcessHeap () returned 0x560000 [0053.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f9a8 | out: hHeap=0x560000) returned 1 [0053.260] GetProcessHeap () returned 0x560000 [0053.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0053.260] GetProcessHeap () returned 0x560000 [0053.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.260] GetProcessHeap () returned 0x560000 [0053.260] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ac8 | out: hHeap=0x560000) returned 1 [0053.260] WriteFile (in: hFile=0x230, lpBuffer=0x5a76f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a76f0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.264] GetProcessHeap () returned 0x560000 [0053.264] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a76f0, Size=0x30) returned 0x5a76f0 [0053.264] GetProcessHeap () returned 0x560000 [0053.264] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.264] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.264] GetProcessHeap () returned 0x560000 [0053.264] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x2735) returned 0x5a7728 [0053.264] ReadFile (in: hFile=0x230, lpBuffer=0x5a7728, nNumberOfBytesToRead=0x2735, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7728*, lpNumberOfBytesRead=0x24ad7e8*=0x2735, lpOverlapped=0x0) returned 1 [0053.265] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.265] WriteFile (in: hFile=0x230, lpBuffer=0x5a7728*, nNumberOfBytesToWrite=0x2735, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7728*, lpNumberOfBytesWritten=0x24ad7e4*=0x2735, lpOverlapped=0x0) returned 1 [0053.266] GetProcessHeap () returned 0x560000 [0053.266] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7728 | out: hHeap=0x560000) returned 1 [0053.266] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.266] WriteFile (in: hFile=0x230, lpBuffer=0x5a76f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a76f0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.267] CloseHandle (hObject=0x230) returned 1 [0053.267] GetProcessHeap () returned 0x560000 [0053.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d238 | out: hHeap=0x560000) returned 1 [0053.267] GetProcessHeap () returned 0x560000 [0053.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.267] GetProcessHeap () returned 0x560000 [0053.267] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586710 | out: hHeap=0x560000) returned 1 [0053.267] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx" [0053.267] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx.badday" [0053.268] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\b7swmi8dsm.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\b7swmi8dsm.xlsx.badday"), dwFlags=0x1) returned 1 [0053.268] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\B7SWmi8Dsm.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4") returned 1 [0053.268] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="" [0053.268] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" [0053.268] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\how_to_back_files.html")) returned 0xffffffff [0053.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0053.268] GetProcessHeap () returned 0x560000 [0053.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.268] GetProcessHeap () returned 0x560000 [0053.268] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586c60 [0053.275] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.276] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.277] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.280] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.287] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.289] GetProcessHeap () returned 0x560000 [0053.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.289] GetProcessHeap () returned 0x560000 [0053.289] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586c60 | out: hHeap=0x560000) returned 1 [0053.289] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0053.289] GetProcessHeap () returned 0x560000 [0053.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.289] GetProcessHeap () returned 0x560000 [0053.289] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587128 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.297] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.298] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.301] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.304] GetProcessHeap () returned 0x560000 [0053.304] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.305] GetProcessHeap () returned 0x560000 [0053.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587128 | out: hHeap=0x560000) returned 1 [0053.305] CloseHandle (hObject=0x230) returned 1 [0053.305] GetProcessHeap () returned 0x560000 [0053.305] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.305] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5c66e0, ftCreationTime.dwHighDateTime=0x1d4c879, ftLastAccessTime.dwLowDateTime=0x90dcee80, ftLastAccessTime.dwHighDateTime=0x1d4cb4f, ftLastWriteTime.dwLowDateTime=0x90dcee80, ftLastWriteTime.dwHighDateTime=0x1d4cb4f, nFileSizeHigh=0x0, nFileSizeLow=0x7549, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bdphfSd Kq-N.pptx", cAlternateFileName="BDPHFS~1.PPT")) returned 1 [0053.305] lstrcmpiW (lpString1="bdphfSd Kq-N.pptx", lpString2=".") returned 1 [0053.305] lstrcmpiW (lpString1="bdphfSd Kq-N.pptx", lpString2="..") returned 1 [0053.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="bdphfSd Kq-N.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx" [0053.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdphfSd Kq-N.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0053.305] GetProcessHeap () returned 0x560000 [0053.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576a58 [0053.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdphfSd Kq-N.pptx", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdphfSd Kq-N.pptx", lpUsedDefaultChar=0x0) returned 18 [0053.305] lstrlenA (lpString="bdphfSd Kq-N.pptx") returned 17 [0053.305] lstrlenA (lpString=".badday") returned 7 [0053.305] lstrlenA (lpString=".badday") returned 7 [0053.305] lstrlenA (lpString="bdphfSd Kq-N.pptx") returned 17 [0053.305] lstrcmpiA (lpString1="-N.pptx", lpString2=".badday") returned 1 [0053.305] lstrcmpiW (lpString1="bdphfSd Kq-N.pptx", lpString2="how_to_back_files.html") returned -1 [0053.305] lstrcmpiW (lpString1="bdphfSd Kq-N.pptx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.305] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.305] lstrcmpiW (lpString1="bdphfSd Kq-N.pptx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.305] GetProcessHeap () returned 0x560000 [0053.305] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d288 [0053.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\bdphfsd kq-n.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.305] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=30025) returned 1 [0053.306] GetProcessHeap () returned 0x560000 [0053.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.306] GetProcessHeap () returned 0x560000 [0053.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586bd8 [0053.306] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx") returned 54 [0053.306] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.306] GetProcessHeap () returned 0x560000 [0053.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.306] GetProcessHeap () returned 0x560000 [0053.306] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7728 [0053.306] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.306] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x587458) returned 1 [0053.346] CryptGenRandom (in: hProv=0x587458, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.346] CryptReleaseContext (hProv=0x587458, dwFlags=0x0) returned 1 [0053.346] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.346] GetProcessHeap () returned 0x560000 [0053.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587348 [0053.348] lstrlenA (lpString="010001") returned 6 [0053.348] GetProcessHeap () returned 0x560000 [0053.348] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0053.358] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586930 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fb58 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586930 | out: hHeap=0x560000) returned 1 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fac8 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a2288 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1568 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1680 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5868a8 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a19c8 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a00f8 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5868a8 | out: hHeap=0x560000) returned 1 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0053.359] GetProcessHeap () returned 0x560000 [0053.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a00f8 | out: hHeap=0x560000) returned 1 [0053.359] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7690 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f5b8 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7690 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1450 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f5b8 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.360] GetProcessHeap () returned 0x560000 [0053.360] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.360] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.361] GetProcessHeap () returned 0x560000 [0053.361] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.361] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.362] GetProcessHeap () returned 0x560000 [0053.362] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.362] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.363] GetProcessHeap () returned 0x560000 [0053.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.363] GetProcessHeap () returned 0x560000 [0053.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1680 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.364] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2288 | out: hHeap=0x560000) returned 1 [0053.364] GetProcessHeap () returned 0x560000 [0053.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb58 | out: hHeap=0x560000) returned 1 [0053.365] GetProcessHeap () returned 0x560000 [0053.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1568 | out: hHeap=0x560000) returned 1 [0053.365] GetProcessHeap () returned 0x560000 [0053.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.365] GetProcessHeap () returned 0x560000 [0053.365] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587348 | out: hHeap=0x560000) returned 1 [0053.365] WriteFile (in: hFile=0x230, lpBuffer=0x5a7728*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7728*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.367] GetProcessHeap () returned 0x560000 [0053.367] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7728, Size=0x30) returned 0x5a7728 [0053.367] GetProcessHeap () returned 0x560000 [0053.367] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.367] GetProcessHeap () returned 0x560000 [0053.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7549) returned 0x5a7760 [0053.367] ReadFile (in: hFile=0x230, lpBuffer=0x5a7760, nNumberOfBytesToRead=0x7549, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7760*, lpNumberOfBytesRead=0x24ad7e8*=0x7549, lpOverlapped=0x0) returned 1 [0053.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.367] WriteFile (in: hFile=0x230, lpBuffer=0x5a7760*, nNumberOfBytesToWrite=0x7549, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7760*, lpNumberOfBytesWritten=0x24ad7e4*=0x7549, lpOverlapped=0x0) returned 1 [0053.369] GetProcessHeap () returned 0x560000 [0053.370] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7760 | out: hHeap=0x560000) returned 1 [0053.370] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.370] WriteFile (in: hFile=0x230, lpBuffer=0x5a7728*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7728*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.371] CloseHandle (hObject=0x230) returned 1 [0053.371] GetProcessHeap () returned 0x560000 [0053.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d288 | out: hHeap=0x560000) returned 1 [0053.371] GetProcessHeap () returned 0x560000 [0053.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.371] GetProcessHeap () returned 0x560000 [0053.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586bd8 | out: hHeap=0x560000) returned 1 [0053.371] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx" [0053.371] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx.badday" [0053.371] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\bdphfsd kq-n.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\bdphfsd kq-n.pptx.badday"), dwFlags=0x1) returned 1 [0053.372] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\bdphfSd Kq-N.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4") returned 1 [0053.372] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="" [0053.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" [0053.372] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\how_to_back_files.html")) returned 0x20 [0053.372] GetProcessHeap () returned 0x560000 [0053.372] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0053.372] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5f28110, ftCreationTime.dwHighDateTime=0x1d4cdc6, ftLastAccessTime.dwLowDateTime=0xbb115980, ftLastAccessTime.dwHighDateTime=0x1d4cf40, ftLastWriteTime.dwLowDateTime=0xbb115980, ftLastWriteTime.dwHighDateTime=0x1d4cf40, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BLzoyJQqzBMgCvAsyi.xls", cAlternateFileName="BLZOYJ~1.XLS")) returned 1 [0053.372] lstrcmpiW (lpString1="BLzoyJQqzBMgCvAsyi.xls", lpString2=".") returned 1 [0053.372] lstrcmpiW (lpString1="BLzoyJQqzBMgCvAsyi.xls", lpString2="..") returned 1 [0053.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="BLzoyJQqzBMgCvAsyi.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls" [0053.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLzoyJQqzBMgCvAsyi.xls", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0053.372] GetProcessHeap () returned 0x560000 [0053.372] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576878 [0053.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLzoyJQqzBMgCvAsyi.xls", cchWideChar=-1, lpMultiByteStr=0x576878, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLzoyJQqzBMgCvAsyi.xls", lpUsedDefaultChar=0x0) returned 23 [0053.372] lstrlenA (lpString="BLzoyJQqzBMgCvAsyi.xls") returned 22 [0053.372] lstrlenA (lpString=".badday") returned 7 [0053.372] lstrlenA (lpString=".badday") returned 7 [0053.372] lstrlenA (lpString="BLzoyJQqzBMgCvAsyi.xls") returned 22 [0053.372] lstrcmpiA (lpString1="syi.xls", lpString2=".badday") returned 1 [0053.372] lstrcmpiW (lpString1="BLzoyJQqzBMgCvAsyi.xls", lpString2="how_to_back_files.html") returned -1 [0053.372] lstrcmpiW (lpString1="BLzoyJQqzBMgCvAsyi.xls", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.373] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.373] lstrcmpiW (lpString1="BLzoyJQqzBMgCvAsyi.xls", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.373] GetProcessHeap () returned 0x560000 [0053.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0053.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\blzoyjqqzbmgcvasyi.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.373] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=74240) returned 1 [0053.373] GetProcessHeap () returned 0x560000 [0053.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.373] GetProcessHeap () returned 0x560000 [0053.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587018 [0053.373] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls") returned 59 [0053.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.373] GetProcessHeap () returned 0x560000 [0053.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.373] GetProcessHeap () returned 0x560000 [0053.373] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7760 [0053.373] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.373] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x5868a8) returned 1 [0053.374] CryptGenRandom (in: hProv=0x5868a8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.374] CryptReleaseContext (hProv=0x5868a8, dwFlags=0x0) returned 1 [0053.374] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5870a0 [0053.374] lstrlenA (lpString="010001") returned 6 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5874e0 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ff48 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874e0 | out: hHeap=0x560000) returned 1 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0068 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1680 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a088 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1798 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a18b0 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586bd8 [0053.374] GetProcessHeap () returned 0x560000 [0053.374] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1450 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a0188 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586bd8 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a2170 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0188 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a74c8 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f408 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a74c8 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f408 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.375] GetProcessHeap () returned 0x560000 [0053.375] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.376] GetProcessHeap () returned 0x560000 [0053.376] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.376] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.377] GetProcessHeap () returned 0x560000 [0053.377] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.377] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.378] GetProcessHeap () returned 0x560000 [0053.378] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.379] GetProcessHeap () returned 0x560000 [0053.379] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a18b0 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2170 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1450 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a0068 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1680 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff48 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1798 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.380] GetProcessHeap () returned 0x560000 [0053.380] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5870a0 | out: hHeap=0x560000) returned 1 [0053.380] WriteFile (in: hFile=0x230, lpBuffer=0x5a7760*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7760*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.382] GetProcessHeap () returned 0x560000 [0053.382] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7760, Size=0x30) returned 0x5a7760 [0053.382] GetProcessHeap () returned 0x560000 [0053.382] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.382] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.382] GetProcessHeap () returned 0x560000 [0053.382] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12200) returned 0x5a7798 [0053.382] ReadFile (in: hFile=0x230, lpBuffer=0x5a7798, nNumberOfBytesToRead=0x12200, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7798*, lpNumberOfBytesRead=0x24ad7e8*=0x12200, lpOverlapped=0x0) returned 1 [0053.383] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.383] WriteFile (in: hFile=0x230, lpBuffer=0x5a7798*, nNumberOfBytesToWrite=0x12200, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7798*, lpNumberOfBytesWritten=0x24ad7e4*=0x12200, lpOverlapped=0x0) returned 1 [0053.492] GetProcessHeap () returned 0x560000 [0053.492] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7798 | out: hHeap=0x560000) returned 1 [0053.494] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.494] WriteFile (in: hFile=0x230, lpBuffer=0x5a7760*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7760*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.495] CloseHandle (hObject=0x230) returned 1 [0053.495] GetProcessHeap () returned 0x560000 [0053.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0053.495] GetProcessHeap () returned 0x560000 [0053.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.495] GetProcessHeap () returned 0x560000 [0053.495] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587018 | out: hHeap=0x560000) returned 1 [0053.495] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls" [0053.495] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls.badday" [0053.495] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\blzoyjqqzbmgcvasyi.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\blzoyjqqzbmgcvasyi.xls.badday"), dwFlags=0x1) returned 1 [0053.498] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\BLzoyJQqzBMgCvAsyi.xls" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4") returned 1 [0053.498] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="" [0053.498] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" [0053.498] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\how_to_back_files.html")) returned 0x20 [0053.498] GetProcessHeap () returned 0x560000 [0053.498] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576878 | out: hHeap=0x560000) returned 1 [0053.498] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0180b60, ftCreationTime.dwHighDateTime=0x1d4cdd4, ftLastAccessTime.dwLowDateTime=0xaf84bc00, ftLastAccessTime.dwHighDateTime=0x1d4c780, ftLastWriteTime.dwLowDateTime=0xaf84bc00, ftLastWriteTime.dwHighDateTime=0x1d4c780, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EWE9-cFuyMhTyV-qWa.doc", cAlternateFileName="EWE9-C~1.DOC")) returned 1 [0053.499] lstrcmpiW (lpString1="EWE9-cFuyMhTyV-qWa.doc", lpString2=".") returned 1 [0053.499] lstrcmpiW (lpString1="EWE9-cFuyMhTyV-qWa.doc", lpString2="..") returned 1 [0053.499] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="EWE9-cFuyMhTyV-qWa.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc" [0053.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EWE9-cFuyMhTyV-qWa.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0053.499] GetProcessHeap () returned 0x560000 [0053.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x576a58 [0053.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EWE9-cFuyMhTyV-qWa.doc", cchWideChar=-1, lpMultiByteStr=0x576a58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EWE9-cFuyMhTyV-qWa.doc", lpUsedDefaultChar=0x0) returned 23 [0053.499] lstrlenA (lpString="EWE9-cFuyMhTyV-qWa.doc") returned 22 [0053.499] lstrlenA (lpString=".badday") returned 7 [0053.499] lstrlenA (lpString=".badday") returned 7 [0053.499] lstrlenA (lpString="EWE9-cFuyMhTyV-qWa.doc") returned 22 [0053.499] lstrcmpiA (lpString1="qWa.doc", lpString2=".badday") returned 1 [0053.499] lstrcmpiW (lpString1="EWE9-cFuyMhTyV-qWa.doc", lpString2="how_to_back_files.html") returned -1 [0053.499] lstrcmpiW (lpString1="EWE9-cFuyMhTyV-qWa.doc", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.499] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.499] lstrcmpiW (lpString1="EWE9-cFuyMhTyV-qWa.doc", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.499] GetProcessHeap () returned 0x560000 [0053.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d378 [0053.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\ewe9-cfuymhtyv-qwa.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.499] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=9100) returned 1 [0053.499] GetProcessHeap () returned 0x560000 [0053.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.499] GetProcessHeap () returned 0x560000 [0053.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586bd8 [0053.499] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc") returned 59 [0053.499] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.499] GetProcessHeap () returned 0x560000 [0053.499] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.500] GetProcessHeap () returned 0x560000 [0053.500] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7798 [0053.500] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.500] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586e80) returned 1 [0053.501] CryptGenRandom (in: hProv=0x586e80, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.501] CryptReleaseContext (hProv=0x586e80, dwFlags=0x0) returned 1 [0053.501] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587348 [0053.501] lstrlenA (lpString="010001") returned 6 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ac8 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f768 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ac8 | out: hHeap=0x560000) returned 1 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fac8 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1ae0 [0053.501] GetProcessHeap () returned 0x560000 [0053.501] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a148 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1d10 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586d70 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a1e28 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ff48 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d70 | out: hHeap=0x560000) returned 1 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1f40 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff48 | out: hHeap=0x560000) returned 1 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7600 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f648 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7600 | out: hHeap=0x560000) returned 1 [0053.502] GetProcessHeap () returned 0x560000 [0053.502] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1680 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f648 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.503] GetProcessHeap () returned 0x560000 [0053.503] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.503] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.504] GetProcessHeap () returned 0x560000 [0053.504] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.504] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.505] GetProcessHeap () returned 0x560000 [0053.505] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.506] GetProcessHeap () returned 0x560000 [0053.506] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.506] GetProcessHeap () returned 0x560000 [0053.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1d10 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f40 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1e28 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1680 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1ae0 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f768 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.507] GetProcessHeap () returned 0x560000 [0053.507] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587348 | out: hHeap=0x560000) returned 1 [0053.507] WriteFile (in: hFile=0x230, lpBuffer=0x5a7798*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7798*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.510] GetProcessHeap () returned 0x560000 [0053.510] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7798, Size=0x30) returned 0x5a7798 [0053.510] GetProcessHeap () returned 0x560000 [0053.510] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.510] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.510] GetProcessHeap () returned 0x560000 [0053.510] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x238c) returned 0x5a77d0 [0053.511] ReadFile (in: hFile=0x230, lpBuffer=0x5a77d0, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a77d0*, lpNumberOfBytesRead=0x24ad7e8*=0x238c, lpOverlapped=0x0) returned 1 [0053.511] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.511] WriteFile (in: hFile=0x230, lpBuffer=0x5a77d0*, nNumberOfBytesToWrite=0x238c, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a77d0*, lpNumberOfBytesWritten=0x24ad7e4*=0x238c, lpOverlapped=0x0) returned 1 [0053.512] GetProcessHeap () returned 0x560000 [0053.512] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a77d0 | out: hHeap=0x560000) returned 1 [0053.512] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.512] WriteFile (in: hFile=0x230, lpBuffer=0x5a7798*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7798*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.513] CloseHandle (hObject=0x230) returned 1 [0053.516] GetProcessHeap () returned 0x560000 [0053.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d378 | out: hHeap=0x560000) returned 1 [0053.516] GetProcessHeap () returned 0x560000 [0053.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.516] GetProcessHeap () returned 0x560000 [0053.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586bd8 | out: hHeap=0x560000) returned 1 [0053.516] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc" [0053.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc.badday" [0053.516] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\ewe9-cfuymhtyv-qwa.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\ewe9-cfuymhtyv-qwa.doc.badday"), dwFlags=0x1) returned 1 [0053.516] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\EWE9-cFuyMhTyV-qWa.doc" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4") returned 1 [0053.516] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="" [0053.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" [0053.516] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\how_to_back_files.html")) returned 0x20 [0053.517] GetProcessHeap () returned 0x560000 [0053.517] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576a58 | out: hHeap=0x560000) returned 1 [0053.517] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e0a1d0, ftCreationTime.dwHighDateTime=0x1d4caab, ftLastAccessTime.dwLowDateTime=0x6301bd70, ftLastAccessTime.dwHighDateTime=0x1d4d3a5, ftLastWriteTime.dwLowDateTime=0x6301bd70, ftLastWriteTime.dwHighDateTime=0x1d4d3a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GQdmFrr3CHs", cAlternateFileName="GQDMFR~1")) returned 1 [0053.517] lstrcmpiW (lpString1="GQdmFrr3CHs", lpString2=".") returned 1 [0053.517] lstrcmpiW (lpString1="GQdmFrr3CHs", lpString2="..") returned 1 [0053.517] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="GQdmFrr3CHs" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs" [0053.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GQdmFrr3CHs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.517] GetProcessHeap () returned 0x560000 [0053.517] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x57ec40 [0053.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GQdmFrr3CHs", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GQdmFrr3CHs", lpUsedDefaultChar=0x0) returned 12 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0053.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0053.518] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="GQdmFrr3CHs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0053.518] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\" [0053.518] GetProcessHeap () returned 0x560000 [0053.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d8 [0053.518] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned 49 [0053.518] GetProcessHeap () returned 0x560000 [0053.518] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x64) returned 0x566e98 [0053.518] lstrcpyW (in: lpString1=0x566e98, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\" [0053.519] GetProcessHeap () returned 0x560000 [0053.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.519] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77cd36a0, ftCreationTime.dwHighDateTime=0x1d4d047, ftLastAccessTime.dwLowDateTime=0x2ba826b0, ftLastAccessTime.dwHighDateTime=0x1d4c80c, ftLastWriteTime.dwLowDateTime=0x2ba826b0, ftLastWriteTime.dwHighDateTime=0x1d4c80c, nFileSizeHigh=0x0, nFileSizeLow=0xe6cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tx4bREPAF.odt", cAlternateFileName="TX4BRE~1.ODT")) returned 1 [0053.519] lstrcmpiW (lpString1="tx4bREPAF.odt", lpString2=".") returned 1 [0053.519] lstrcmpiW (lpString1="tx4bREPAF.odt", lpString2="..") returned 1 [0053.519] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="tx4bREPAF.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt" [0053.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tx4bREPAF.odt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0053.519] GetProcessHeap () returned 0x560000 [0053.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x57ec40 [0053.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tx4bREPAF.odt", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tx4bREPAF.odt", lpUsedDefaultChar=0x0) returned 14 [0053.519] lstrlenA (lpString="tx4bREPAF.odt") returned 13 [0053.519] lstrlenA (lpString=".badday") returned 7 [0053.519] lstrlenA (lpString=".badday") returned 7 [0053.519] lstrlenA (lpString="tx4bREPAF.odt") returned 13 [0053.519] lstrcmpiA (lpString1="PAF.odt", lpString2=".badday") returned 1 [0053.519] lstrcmpiW (lpString1="tx4bREPAF.odt", lpString2="how_to_back_files.html") returned 1 [0053.519] lstrcmpiW (lpString1="tx4bREPAF.odt", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.519] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.519] lstrcmpiW (lpString1="tx4bREPAF.odt", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0053.519] GetProcessHeap () returned 0x560000 [0053.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d1e8 [0053.519] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\tx4brepaf.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.519] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=59087) returned 1 [0053.519] GetProcessHeap () returned 0x560000 [0053.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.519] GetProcessHeap () returned 0x560000 [0053.519] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586798 [0053.519] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt") returned 50 [0053.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.520] GetProcessHeap () returned 0x560000 [0053.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.520] GetProcessHeap () returned 0x560000 [0053.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a77d0 [0053.520] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.520] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586820) returned 1 [0053.520] CryptGenRandom (in: hProv=0x586820, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.520] CryptReleaseContext (hProv=0x586820, dwFlags=0x0) returned 1 [0053.520] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.520] GetProcessHeap () returned 0x560000 [0053.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586f08 [0053.520] lstrlenA (lpString="010001") returned 6 [0053.520] GetProcessHeap () returned 0x560000 [0053.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0053.520] GetProcessHeap () returned 0x560000 [0053.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586a40 [0053.520] GetProcessHeap () returned 0x560000 [0053.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f498 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586a40 | out: hHeap=0x560000) returned 1 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59ff48 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a1568 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a058 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1bf8 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1680 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587018 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a2288 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a73d8 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f528 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587018 | out: hHeap=0x560000) returned 1 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a19c8 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f528 | out: hHeap=0x560000) returned 1 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.521] GetProcessHeap () returned 0x560000 [0053.521] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7528 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f918 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7528 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a1f40 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f918 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.522] GetProcessHeap () returned 0x560000 [0053.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.522] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.523] GetProcessHeap () returned 0x560000 [0053.523] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.523] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.524] GetProcessHeap () returned 0x560000 [0053.524] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.524] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.525] GetProcessHeap () returned 0x560000 [0053.525] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.525] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1680 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a19c8 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2288 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1f40 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a73d8 | out: hHeap=0x560000) returned 1 [0053.526] GetProcessHeap () returned 0x560000 [0053.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ff48 | out: hHeap=0x560000) returned 1 [0053.527] GetProcessHeap () returned 0x560000 [0053.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1568 | out: hHeap=0x560000) returned 1 [0053.527] GetProcessHeap () returned 0x560000 [0053.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f498 | out: hHeap=0x560000) returned 1 [0053.527] GetProcessHeap () returned 0x560000 [0053.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a1bf8 | out: hHeap=0x560000) returned 1 [0053.527] GetProcessHeap () returned 0x560000 [0053.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.527] GetProcessHeap () returned 0x560000 [0053.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f08 | out: hHeap=0x560000) returned 1 [0053.527] WriteFile (in: hFile=0x230, lpBuffer=0x5a77d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a77d0*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.529] GetProcessHeap () returned 0x560000 [0053.529] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a77d0, Size=0x30) returned 0x5a77d0 [0053.529] GetProcessHeap () returned 0x560000 [0053.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.529] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.529] GetProcessHeap () returned 0x560000 [0053.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe6cf) returned 0x5a7808 [0053.530] ReadFile (in: hFile=0x230, lpBuffer=0x5a7808, nNumberOfBytesToRead=0xe6cf, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7808*, lpNumberOfBytesRead=0x24ad7e8*=0xe6cf, lpOverlapped=0x0) returned 1 [0053.531] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.531] WriteFile (in: hFile=0x230, lpBuffer=0x5a7808*, nNumberOfBytesToWrite=0xe6cf, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7808*, lpNumberOfBytesWritten=0x24ad7e4*=0xe6cf, lpOverlapped=0x0) returned 1 [0053.532] GetProcessHeap () returned 0x560000 [0053.532] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7808 | out: hHeap=0x560000) returned 1 [0053.532] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.532] WriteFile (in: hFile=0x230, lpBuffer=0x5a77d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a77d0*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.533] CloseHandle (hObject=0x230) returned 1 [0053.540] GetProcessHeap () returned 0x560000 [0053.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d1e8 | out: hHeap=0x560000) returned 1 [0053.540] GetProcessHeap () returned 0x560000 [0053.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.540] GetProcessHeap () returned 0x560000 [0053.540] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586798 | out: hHeap=0x560000) returned 1 [0053.540] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt" [0053.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt.badday" [0053.540] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\tx4brepaf.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\tx4brepaf.odt.badday"), dwFlags=0x1) returned 1 [0053.541] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\tx4bREPAF.odt" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4") returned 1 [0053.541] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\") returned="" [0053.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" [0053.541] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\how_to_back_files.html")) returned 0x20 [0053.542] GetProcessHeap () returned 0x560000 [0053.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.542] FindNextFileW (in: hFindFile=0x579448, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77cd36a0, ftCreationTime.dwHighDateTime=0x1d4d047, ftLastAccessTime.dwLowDateTime=0x2ba826b0, ftLastAccessTime.dwHighDateTime=0x1d4c80c, ftLastWriteTime.dwLowDateTime=0x2ba826b0, ftLastWriteTime.dwHighDateTime=0x1d4c80c, nFileSizeHigh=0x0, nFileSizeLow=0xe6cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tx4bREPAF.odt", cAlternateFileName="TX4BRE~1.ODT")) returned 0 [0053.542] FindClose (in: hFindFile=0x579448 | out: hFindFile=0x579448) returned 1 [0053.542] lstrcpyW (in: lpString1=0x24adf84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\" [0053.542] GetProcessHeap () returned 0x560000 [0053.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x566e98 | out: hHeap=0x560000) returned 1 [0053.542] GetProcessHeap () returned 0x560000 [0053.542] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.542] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned 49 [0053.542] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\*") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\*" [0053.542] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\*", lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e0a1d0, ftCreationTime.dwHighDateTime=0x1d4caab, ftLastAccessTime.dwLowDateTime=0x6301bd70, ftLastAccessTime.dwHighDateTime=0x1d4d3a5, ftLastWriteTime.dwLowDateTime=0x6301bd70, ftLastWriteTime.dwHighDateTime=0x1d4d3a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5797c8 [0053.542] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.542] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e0a1d0, ftCreationTime.dwHighDateTime=0x1d4caab, ftLastAccessTime.dwLowDateTime=0x6301bd70, ftLastAccessTime.dwHighDateTime=0x1d4d3a5, ftLastWriteTime.dwLowDateTime=0x6301bd70, ftLastWriteTime.dwHighDateTime=0x1d4d3a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.542] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.542] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.542] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed032c0, ftCreationTime.dwHighDateTime=0x1d4cd6b, ftLastAccessTime.dwLowDateTime=0x767377b0, ftLastAccessTime.dwHighDateTime=0x1d4cc91, ftLastWriteTime.dwLowDateTime=0x767377b0, ftLastWriteTime.dwHighDateTime=0x1d4cc91, nFileSizeHigh=0x0, nFileSizeLow=0x70ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6p52wZbrAU6EYd9FPc.csv", cAlternateFileName="6P52WZ~1.CSV")) returned 1 [0053.542] lstrcmpiW (lpString1="6p52wZbrAU6EYd9FPc.csv", lpString2=".") returned 1 [0053.542] lstrcmpiW (lpString1="6p52wZbrAU6EYd9FPc.csv", lpString2="..") returned 1 [0053.542] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="6p52wZbrAU6EYd9FPc.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv" [0053.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6p52wZbrAU6EYd9FPc.csv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0053.542] GetProcessHeap () returned 0x560000 [0053.542] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x17) returned 0x5769f8 [0053.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6p52wZbrAU6EYd9FPc.csv", cchWideChar=-1, lpMultiByteStr=0x5769f8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6p52wZbrAU6EYd9FPc.csv", lpUsedDefaultChar=0x0) returned 23 [0053.542] lstrlenA (lpString="6p52wZbrAU6EYd9FPc.csv") returned 22 [0053.542] lstrlenA (lpString=".badday") returned 7 [0053.542] lstrlenA (lpString=".badday") returned 7 [0053.543] lstrlenA (lpString="6p52wZbrAU6EYd9FPc.csv") returned 22 [0053.543] lstrcmpiA (lpString1="FPc.csv", lpString2=".badday") returned 1 [0053.543] lstrcmpiW (lpString1="6p52wZbrAU6EYd9FPc.csv", lpString2="how_to_back_files.html") returned -1 [0053.543] lstrcmpiW (lpString1="6p52wZbrAU6EYd9FPc.csv", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned -1 [0053.543] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.543] lstrcmpiW (lpString1="6p52wZbrAU6EYd9FPc.csv", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.543] GetProcessHeap () returned 0x560000 [0053.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d440 [0053.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\6p52wzbrau6eyd9fpc.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.543] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=28878) returned 1 [0053.543] GetProcessHeap () returned 0x560000 [0053.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.543] GetProcessHeap () returned 0x560000 [0053.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5874e0 [0053.543] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv") returned 71 [0053.543] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.543] GetProcessHeap () returned 0x560000 [0053.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.543] GetProcessHeap () returned 0x560000 [0053.543] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7808 [0053.543] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.543] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586ac8) returned 1 [0053.544] CryptGenRandom (in: hProv=0x586ac8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.544] CryptReleaseContext (hProv=0x586ac8, dwFlags=0x0) returned 1 [0053.544] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ce8 [0053.544] lstrlenA (lpString="010001") returned 6 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ac8 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fbe8 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ac8 | out: hHeap=0x560000) returned 1 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f528 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a6c38 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6d50 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.544] GetProcessHeap () returned 0x560000 [0053.544] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6e68 [0053.544] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586600 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a6f80 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x5a00f8 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586600 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a7098 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a00f8 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a73a8 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59fc78 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a73a8 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6260 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fc78 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.545] GetProcessHeap () returned 0x560000 [0053.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.545] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.546] GetProcessHeap () returned 0x560000 [0053.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.547] GetProcessHeap () returned 0x560000 [0053.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.548] GetProcessHeap () returned 0x560000 [0053.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.549] GetProcessHeap () returned 0x560000 [0053.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.549] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6e68 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7098 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6f80 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6260 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f528 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6c38 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fbe8 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6d50 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.550] GetProcessHeap () returned 0x560000 [0053.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ce8 | out: hHeap=0x560000) returned 1 [0053.550] WriteFile (in: hFile=0x230, lpBuffer=0x5a7808*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7808*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.552] GetProcessHeap () returned 0x560000 [0053.552] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7808, Size=0x30) returned 0x5a7808 [0053.552] GetProcessHeap () returned 0x560000 [0053.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.552] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.552] GetProcessHeap () returned 0x560000 [0053.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x70ce) returned 0x5a7840 [0053.552] ReadFile (in: hFile=0x230, lpBuffer=0x5a7840, nNumberOfBytesToRead=0x70ce, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7840*, lpNumberOfBytesRead=0x24ad7e8*=0x70ce, lpOverlapped=0x0) returned 1 [0053.553] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.553] WriteFile (in: hFile=0x230, lpBuffer=0x5a7840*, nNumberOfBytesToWrite=0x70ce, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7840*, lpNumberOfBytesWritten=0x24ad7e4*=0x70ce, lpOverlapped=0x0) returned 1 [0053.554] GetProcessHeap () returned 0x560000 [0053.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7840 | out: hHeap=0x560000) returned 1 [0053.554] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.554] WriteFile (in: hFile=0x230, lpBuffer=0x5a7808*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7808*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.555] CloseHandle (hObject=0x230) returned 1 [0053.555] GetProcessHeap () returned 0x560000 [0053.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x560000) returned 1 [0053.555] GetProcessHeap () returned 0x560000 [0053.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.555] GetProcessHeap () returned 0x560000 [0053.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5874e0 | out: hHeap=0x560000) returned 1 [0053.555] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv" [0053.555] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv.badday" [0053.555] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\6p52wzbrau6eyd9fpc.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\6p52wzbrau6eyd9fpc.csv.badday"), dwFlags=0x1) returned 1 [0053.557] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\6p52wZbrAU6EYd9FPc.csv" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs") returned 1 [0053.557] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned="" [0053.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" [0053.557] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\how_to_back_files.html")) returned 0xffffffff [0053.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\how_to_back_files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0053.558] GetProcessHeap () returned 0x560000 [0053.558] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.558] GetProcessHeap () returned 0x560000 [0053.558] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5869b8 [0053.564] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.565] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.566] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.567] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.568] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.569] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.570] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.571] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.572] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.574] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.575] GetProcessHeap () returned 0x560000 [0053.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.575] GetProcessHeap () returned 0x560000 [0053.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869b8 | out: hHeap=0x560000) returned 1 [0053.575] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24ad9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x24ad9d0*=0x300, lpOverlapped=0x0) returned 1 [0053.575] GetProcessHeap () returned 0x560000 [0053.575] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.575] GetProcessHeap () returned 0x560000 [0053.575] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587238 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.582] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.584] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.586] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.587] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.647] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.648] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.649] WriteFile (in: hFile=0x230, lpBuffer=0x24ad7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x24ad7ec*, lpNumberOfBytesWritten=0x24ad7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.649] GetProcessHeap () returned 0x560000 [0053.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.649] GetProcessHeap () returned 0x560000 [0053.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587238 | out: hHeap=0x560000) returned 1 [0053.649] CloseHandle (hObject=0x230) returned 1 [0053.649] GetProcessHeap () returned 0x560000 [0053.649] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5769f8 | out: hHeap=0x560000) returned 1 [0053.649] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfec7b7a0, ftCreationTime.dwHighDateTime=0x1d4c711, ftLastAccessTime.dwLowDateTime=0xf1e39680, ftLastAccessTime.dwHighDateTime=0x1d4c8bf, ftLastWriteTime.dwLowDateTime=0xf1e39680, ftLastWriteTime.dwHighDateTime=0x1d4c8bf, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gxef_.odp", cAlternateFileName="")) returned 1 [0053.649] lstrcmpiW (lpString1="Gxef_.odp", lpString2=".") returned 1 [0053.649] lstrcmpiW (lpString1="Gxef_.odp", lpString2="..") returned 1 [0053.649] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="Gxef_.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp" [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Gxef_.odp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.650] GetProcessHeap () returned 0x560000 [0053.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x57ec40 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Gxef_.odp", cchWideChar=-1, lpMultiByteStr=0x57ec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gxef_.odp", lpUsedDefaultChar=0x0) returned 10 [0053.650] lstrlenA (lpString="Gxef_.odp") returned 9 [0053.650] lstrlenA (lpString=".badday") returned 7 [0053.650] lstrlenA (lpString=".badday") returned 7 [0053.650] lstrlenA (lpString="Gxef_.odp") returned 9 [0053.650] lstrcmpiA (lpString1="ef_.odp", lpString2=".badday") returned 1 [0053.650] lstrcmpiW (lpString1="Gxef_.odp", lpString2="how_to_back_files.html") returned -1 [0053.650] lstrcmpiW (lpString1="Gxef_.odp", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.650] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.650] lstrcmpiW (lpString1="Gxef_.odp", lpString2="LS_APPDATASAMPLE.EXE.exe") returned -1 [0053.650] GetProcessHeap () returned 0x560000 [0053.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d288 [0053.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\gxef_.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.650] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=43408) returned 1 [0053.650] GetProcessHeap () returned 0x560000 [0053.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.650] GetProcessHeap () returned 0x560000 [0053.650] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586bd8 [0053.650] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp") returned 58 [0053.650] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.650] GetProcessHeap () returned 0x560000 [0053.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.651] GetProcessHeap () returned 0x560000 [0053.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7840 [0053.651] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.651] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586d70) returned 1 [0053.651] CryptGenRandom (in: hProv=0x586d70, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.651] CryptReleaseContext (hProv=0x586d70, dwFlags=0x0) returned 1 [0053.651] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.651] GetProcessHeap () returned 0x560000 [0053.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586b50 [0053.651] lstrlenA (lpString="010001") returned 6 [0053.651] GetProcessHeap () returned 0x560000 [0053.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0053.651] GetProcessHeap () returned 0x560000 [0053.651] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586d70 [0053.651] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f9a8 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d70 | out: hHeap=0x560000) returned 1 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f528 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a6a08 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a098 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6d50 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a68f0 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587128 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a6490 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7438 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f648 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587128 | out: hHeap=0x560000) returned 1 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6b20 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f648 | out: hHeap=0x560000) returned 1 [0053.652] GetProcessHeap () returned 0x560000 [0053.652] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.652] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7450 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x5a00f8 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7450 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6c38 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a00f8 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.653] GetProcessHeap () returned 0x560000 [0053.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.654] GetProcessHeap () returned 0x560000 [0053.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.655] GetProcessHeap () returned 0x560000 [0053.655] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.656] GetProcessHeap () returned 0x560000 [0053.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a058 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a058 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a68f0 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6b20 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6490 | out: hHeap=0x560000) returned 1 [0053.657] GetProcessHeap () returned 0x560000 [0053.657] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6c38 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7438 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f528 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6a08 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f9a8 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6d50 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.658] GetProcessHeap () returned 0x560000 [0053.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586b50 | out: hHeap=0x560000) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x5a7840*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7840*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.662] GetProcessHeap () returned 0x560000 [0053.662] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7840, Size=0x30) returned 0x5a7840 [0053.662] GetProcessHeap () returned 0x560000 [0053.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.662] GetProcessHeap () returned 0x560000 [0053.662] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa990) returned 0x5a7878 [0053.662] ReadFile (in: hFile=0x230, lpBuffer=0x5a7878, nNumberOfBytesToRead=0xa990, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a7878*, lpNumberOfBytesRead=0x24ad7e8*=0xa990, lpOverlapped=0x0) returned 1 [0053.663] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.663] WriteFile (in: hFile=0x230, lpBuffer=0x5a7878*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a7878*, lpNumberOfBytesWritten=0x24ad7e4*=0xa990, lpOverlapped=0x0) returned 1 [0053.664] GetProcessHeap () returned 0x560000 [0053.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7878 | out: hHeap=0x560000) returned 1 [0053.665] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.665] WriteFile (in: hFile=0x230, lpBuffer=0x5a7840*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7840*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.668] CloseHandle (hObject=0x230) returned 1 [0053.669] GetProcessHeap () returned 0x560000 [0053.669] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d288 | out: hHeap=0x560000) returned 1 [0053.669] GetProcessHeap () returned 0x560000 [0053.669] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.669] GetProcessHeap () returned 0x560000 [0053.669] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586bd8 | out: hHeap=0x560000) returned 1 [0053.669] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp" [0053.669] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp.badday" [0053.669] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\gxef_.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\gxef_.odp.badday"), dwFlags=0x1) returned 1 [0053.670] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\Gxef_.odp" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs") returned 1 [0053.670] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned="" [0053.670] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" [0053.670] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\how_to_back_files.html")) returned 0x20 [0053.670] GetProcessHeap () returned 0x560000 [0053.670] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.670] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7536c700, ftCreationTime.dwHighDateTime=0x1d4c604, ftLastAccessTime.dwLowDateTime=0x1a11d350, ftLastAccessTime.dwHighDateTime=0x1d4d32a, ftLastWriteTime.dwLowDateTime=0x1a11d350, ftLastWriteTime.dwHighDateTime=0x1d4d32a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hp__QfJOSY4L8qpSJJv", cAlternateFileName="HP__QF~1")) returned 1 [0053.670] lstrcmpiW (lpString1="hp__QfJOSY4L8qpSJJv", lpString2=".") returned 1 [0053.670] lstrcmpiW (lpString1="hp__QfJOSY4L8qpSJJv", lpString2="..") returned 1 [0053.670] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="hp__QfJOSY4L8qpSJJv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv" [0053.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hp__QfJOSY4L8qpSJJv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0053.670] GetProcessHeap () returned 0x560000 [0053.670] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576af8 [0053.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hp__QfJOSY4L8qpSJJv", cchWideChar=-1, lpMultiByteStr=0x576af8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hp__QfJOSY4L8qpSJJv", lpUsedDefaultChar=0x0) returned 20 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0053.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0053.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0053.672] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0053.672] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="hp__QfJOSY4L8qpSJJv", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0053.672] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv\\" [0053.672] GetProcessHeap () returned 0x560000 [0053.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a058 [0053.672] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv\\") returned 69 [0053.672] GetProcessHeap () returned 0x560000 [0053.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8c) returned 0x572708 [0053.672] lstrcpyW (in: lpString1=0x572708, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv\\") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\hp__QfJOSY4L8qpSJJv\\" [0053.672] GetProcessHeap () returned 0x560000 [0053.672] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576af8 | out: hHeap=0x560000) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87405ad0, ftCreationTime.dwHighDateTime=0x1d4cfbc, ftLastAccessTime.dwLowDateTime=0xa47f6f70, ftLastAccessTime.dwHighDateTime=0x1d4c89e, ftLastWriteTime.dwLowDateTime=0xa47f6f70, ftLastWriteTime.dwHighDateTime=0x1d4c89e, nFileSizeHigh=0x0, nFileSizeLow=0x12376, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P4JCMRN9u3Um yQo1AN.ods", cAlternateFileName="P4JCMR~1.ODS")) returned 1 [0053.672] lstrcmpiW (lpString1="P4JCMRN9u3Um yQo1AN.ods", lpString2=".") returned 1 [0053.672] lstrcmpiW (lpString1="P4JCMRN9u3Um yQo1AN.ods", lpString2="..") returned 1 [0053.672] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="P4JCMRN9u3Um yQo1AN.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods" [0053.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P4JCMRN9u3Um yQo1AN.ods", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.672] GetProcessHeap () returned 0x560000 [0053.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576838 [0053.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P4JCMRN9u3Um yQo1AN.ods", cchWideChar=-1, lpMultiByteStr=0x576838, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P4JCMRN9u3Um yQo1AN.ods", lpUsedDefaultChar=0x0) returned 24 [0053.672] lstrlenA (lpString="P4JCMRN9u3Um yQo1AN.ods") returned 23 [0053.672] lstrlenA (lpString=".badday") returned 7 [0053.672] lstrlenA (lpString=".badday") returned 7 [0053.672] lstrlenA (lpString="P4JCMRN9u3Um yQo1AN.ods") returned 23 [0053.672] lstrcmpiA (lpString1="1AN.ods", lpString2=".badday") returned 1 [0053.672] lstrcmpiW (lpString1="P4JCMRN9u3Um yQo1AN.ods", lpString2="how_to_back_files.html") returned 1 [0053.672] lstrcmpiW (lpString1="P4JCMRN9u3Um yQo1AN.ods", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.672] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.672] lstrcmpiW (lpString1="P4JCMRN9u3Um yQo1AN.ods", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0053.672] GetProcessHeap () returned 0x560000 [0053.672] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d300 [0053.672] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\p4jcmrn9u3um yqo1an.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.673] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=74614) returned 1 [0053.673] GetProcessHeap () returned 0x560000 [0053.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.673] GetProcessHeap () returned 0x560000 [0053.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586e80 [0053.673] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods") returned 72 [0053.673] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.673] GetProcessHeap () returned 0x560000 [0053.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.673] GetProcessHeap () returned 0x560000 [0053.673] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a7878 [0053.674] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.674] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586ce8) returned 1 [0053.674] CryptGenRandom (in: hProv=0x586ce8, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.674] CryptReleaseContext (hProv=0x586ce8, dwFlags=0x0) returned 1 [0053.674] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.674] GetProcessHeap () returned 0x560000 [0053.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587128 [0053.674] lstrlenA (lpString="010001") returned 6 [0053.674] GetProcessHeap () returned 0x560000 [0053.674] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a138 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x587238 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f918 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587238 | out: hHeap=0x560000) returned 1 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fa38 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a67d8 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0f8 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6b20 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a7098 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586f08 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a6260 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fe28 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586f08 | out: hHeap=0x560000) returned 1 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6378 [0053.675] GetProcessHeap () returned 0x560000 [0053.675] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fe28 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7318 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f498 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7318 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6490 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f498 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.676] GetProcessHeap () returned 0x560000 [0053.676] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.677] GetProcessHeap () returned 0x560000 [0053.677] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.677] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1b8 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1b8 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.678] GetProcessHeap () returned 0x560000 [0053.678] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.678] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0d8 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.679] GetProcessHeap () returned 0x560000 [0053.679] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.679] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a148 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a148 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7098 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6378 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.680] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6260 | out: hHeap=0x560000) returned 1 [0053.680] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6490 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fa38 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a67d8 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f918 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6b20 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.681] GetProcessHeap () returned 0x560000 [0053.681] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x587128 | out: hHeap=0x560000) returned 1 [0053.681] WriteFile (in: hFile=0x230, lpBuffer=0x5a7878*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7878*, lpNumberOfBytesWritten=0x24ad864*=0x380, lpOverlapped=0x0) returned 1 [0053.683] GetProcessHeap () returned 0x560000 [0053.683] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a7878, Size=0x30) returned 0x5a7878 [0053.683] GetProcessHeap () returned 0x560000 [0053.683] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a3b0 | out: hHeap=0x560000) returned 1 [0053.683] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.683] GetProcessHeap () returned 0x560000 [0053.683] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12376) returned 0x5a78b0 [0053.684] ReadFile (in: hFile=0x230, lpBuffer=0x5a78b0, nNumberOfBytesToRead=0x12376, lpNumberOfBytesRead=0x24ad7e8, lpOverlapped=0x0 | out: lpBuffer=0x5a78b0*, lpNumberOfBytesRead=0x24ad7e8*=0x12376, lpOverlapped=0x0) returned 1 [0053.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.685] WriteFile (in: hFile=0x230, lpBuffer=0x5a78b0*, nNumberOfBytesToWrite=0x12376, lpNumberOfBytesWritten=0x24ad7e4, lpOverlapped=0x0 | out: lpBuffer=0x5a78b0*, lpNumberOfBytesWritten=0x24ad7e4*=0x12376, lpOverlapped=0x0) returned 1 [0053.687] GetProcessHeap () returned 0x560000 [0053.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a78b0 | out: hHeap=0x560000) returned 1 [0053.688] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x230, lpBuffer=0x5a7878*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0 | out: lpBuffer=0x5a7878*, lpNumberOfBytesWritten=0x24ad864*=0x30, lpOverlapped=0x0) returned 1 [0053.689] CloseHandle (hObject=0x230) returned 1 [0053.689] GetProcessHeap () returned 0x560000 [0053.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57d300 | out: hHeap=0x560000) returned 1 [0053.689] GetProcessHeap () returned 0x560000 [0053.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x56f490 | out: hHeap=0x560000) returned 1 [0053.689] GetProcessHeap () returned 0x560000 [0053.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e80 | out: hHeap=0x560000) returned 1 [0053.689] lstrcpyW (in: lpString1=0x24aef84, lpString2="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods" [0053.689] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods", lpString2=".badday" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods.badday") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods.badday" [0053.690] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\p4jcmrn9u3um yqo1an.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods.badday" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\p4jcmrn9u3um yqo1an.ods.badday"), dwFlags=0x1) returned 1 [0053.690] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\P4JCMRN9u3Um yQo1AN.ods" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs") returned 1 [0053.690] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\") returned="" [0053.690] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="how_to_back_files.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" [0053.690] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\how_to_back_files.html" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\how_to_back_files.html")) returned 0x20 [0053.690] GetProcessHeap () returned 0x560000 [0053.690] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576838 | out: hHeap=0x560000) returned 1 [0053.690] FindNextFileW (in: hFindFile=0x5797c8, lpFindFileData=0x24ad9f4 | out: lpFindFileData=0x24ad9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5f1c410, ftCreationTime.dwHighDateTime=0x1d4d5e5, ftLastAccessTime.dwLowDateTime=0xc675ad30, ftLastAccessTime.dwHighDateTime=0x1d4d38c, ftLastWriteTime.dwLowDateTime=0xc675ad30, ftLastWriteTime.dwHighDateTime=0x1d4d38c, nFileSizeHigh=0x0, nFileSizeLow=0x13ede, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sSf6kObSlumnyF.docx", cAlternateFileName="SSF6KO~1.DOC")) returned 1 [0053.690] lstrcmpiW (lpString1="sSf6kObSlumnyF.docx", lpString2=".") returned 1 [0053.690] lstrcmpiW (lpString1="sSf6kObSlumnyF.docx", lpString2="..") returned 1 [0053.691] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\", lpString2="sSf6kObSlumnyF.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\sSf6kObSlumnyF.docx") returned="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\sSf6kObSlumnyF.docx" [0053.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sSf6kObSlumnyF.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0053.691] GetProcessHeap () returned 0x560000 [0053.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576b18 [0053.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sSf6kObSlumnyF.docx", cchWideChar=-1, lpMultiByteStr=0x576b18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sSf6kObSlumnyF.docx", lpUsedDefaultChar=0x0) returned 20 [0053.691] lstrlenA (lpString="sSf6kObSlumnyF.docx") returned 19 [0053.691] lstrlenA (lpString=".badday") returned 7 [0053.691] lstrlenA (lpString=".badday") returned 7 [0053.691] lstrlenA (lpString="sSf6kObSlumnyF.docx") returned 19 [0053.691] lstrcmpiA (lpString1="yF.docx", lpString2=".badday") returned 1 [0053.691] lstrcmpiW (lpString1="sSf6kObSlumnyF.docx", lpString2="how_to_back_files.html") returned 1 [0053.691] lstrcmpiW (lpString1="sSf6kObSlumnyF.docx", lpString2="9707F881606F1A60E0A22D9BA3F754EDBD347C63B206910712C150A325D7D8E3") returned 1 [0053.691] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\LS_APPDATASAMPLE.EXE.exe") returned="LS_APPDATASAMPLE.EXE.exe" [0053.691] lstrcmpiW (lpString1="sSf6kObSlumnyF.docx", lpString2="LS_APPDATASAMPLE.EXE.exe") returned 1 [0053.691] GetProcessHeap () returned 0x560000 [0053.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x20) returned 0x57d620 [0053.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\sSf6kObSlumnyF.docx" (normalized: "c:\\users\\fd1hvy\\documents\\73cd5whu_4\\gqdmfrr3chs\\ssf6kobslumnyf.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.691] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x24ad83c | out: lpFileSize=0x24ad83c*=81630) returned 1 [0053.691] GetProcessHeap () returned 0x560000 [0053.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x56f490 [0053.691] GetProcessHeap () returned 0x560000 [0053.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586710 [0053.691] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\73cd5wHU_4\\GQdmFrr3CHs\\sSf6kObSlumnyF.docx") returned 68 [0053.691] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ad800 | out: lpNewFilePointer=0x0) returned 1 [0053.691] GetProcessHeap () returned 0x560000 [0053.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x200) returned 0x58a3b0 [0053.691] GetProcessHeap () returned 0x560000 [0053.691] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x380) returned 0x5a78b0 [0053.692] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.692] CryptAcquireContextW (in: phProv=0x24acd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24acd30*=0x586d70) returned 1 [0053.693] CryptGenRandom (in: hProv=0x586d70, dwLen=0x80, pbBuffer=0x24acd48 | out: pbBuffer=0x24acd48) returned 1 [0053.693] CryptReleaseContext (hProv=0x586d70, dwFlags=0x0) returned 1 [0053.693] lstrlenA (lpString="988B84A224EA3F50C5C186B771D0C9BAB78E09F54E808904C633454292BFDCBC08B75748B0E5FB08CE034E49E7C964C1478A5F82C9195A23D5EEC24CA343182E0330834BEB5A0B10E4F37D54101EE912A801363110D1C8477ED0E528F8FDA828269C72B5DDCC597CC50FCEAA30C3EDA9652D58617EB7EBC3EC265809DE715791") returned 256 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586ce8 [0053.693] lstrlenA (lpString="010001") returned 6 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a0d8 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x586df8 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fac8 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586df8 | out: hHeap=0x560000) returned 1 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59fb58 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x108) returned 0x5a66c0 [0053.693] GetProcessHeap () returned 0x560000 [0053.693] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4) returned 0x58a048 [0053.693] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a65a8 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6a08 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5869b8 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x10c) returned 0x5a6e68 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x57ec40 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x84) returned 0x59f888 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5869b8 | out: hHeap=0x560000) returned 1 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a67d8 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f888 | out: hHeap=0x560000) returned 1 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xc) returned 0x5a7648 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x88) returned 0x59f528 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a7648 | out: hHeap=0x560000) returned 1 [0053.694] GetProcessHeap () returned 0x560000 [0053.694] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x104) returned 0x5a6f80 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59f528 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a098 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a098 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a1c8 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a1c8 | out: hHeap=0x560000) returned 1 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.695] GetProcessHeap () returned 0x560000 [0053.695] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.696] GetProcessHeap () returned 0x560000 [0053.696] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a198 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a198 | out: hHeap=0x560000) returned 1 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a158 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a158 | out: hHeap=0x560000) returned 1 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.697] GetProcessHeap () returned 0x560000 [0053.697] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.697] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a118 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a118 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a048 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a048 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a0f8 [0053.698] GetProcessHeap () returned 0x560000 [0053.698] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0f8 | out: hHeap=0x560000) returned 1 [0053.698] GetProcessHeap () returned 0x560000 [0053.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a168 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a168 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a008 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a008 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a088 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a088 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8) returned 0x58a138 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a138 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6a08 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a67d8 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6e68 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a6f80 | out: hHeap=0x560000) returned 1 [0053.699] GetProcessHeap () returned 0x560000 [0053.699] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x57ec40 | out: hHeap=0x560000) returned 1 [0053.700] GetProcessHeap () returned 0x560000 [0053.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fb58 | out: hHeap=0x560000) returned 1 [0053.700] GetProcessHeap () returned 0x560000 [0053.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a66c0 | out: hHeap=0x560000) returned 1 [0053.700] GetProcessHeap () returned 0x560000 [0053.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59fac8 | out: hHeap=0x560000) returned 1 [0053.700] GetProcessHeap () returned 0x560000 [0053.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a65a8 | out: hHeap=0x560000) returned 1 [0053.700] GetProcessHeap () returned 0x560000 [0053.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x58a0d8 | out: hHeap=0x560000) returned 1 [0053.700] GetProcessHeap () returned 0x560000 [0053.700] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586ce8 | out: hHeap=0x560000) returned 1 [0053.700] WriteFile (hFile=0x230, lpBuffer=0x5a78b0, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24ad864, lpOverlapped=0x0)